Update sample oauth token in crm-schema-h2.sql

The previously inserted authentication associated to the access token was
using the default JVM generated serialVersionUID for the User. Commit
db03bc2a updated User to have a serialVersionUID of 1L which meant when
OAuth tried to deserialize the User object it failed. This issue manifested
itself as a NullPointerException within the JdbcTokenStore.

I have updated the crm-schema-h2.sql to use a newly generated access token.
This means clients that previously had an association to the access token
will need to update their access token to the new value.
Update signout for CSRF support

Previously signout was performing a GET which is no longer valid with the
default JC support.

Now signout performs a POST and includes a CSRF token.
Use Security conventions
Disable Spring Security for /h2/**

Since h2 has its own security, disable Spring Security for it. This makes
the configuration much simpler and allows re-enabling of CSRF for the rest
of the application. Technically we could just disable CSRF for the h2
portion using http.csrf().requireCsrfProtectionMatcher and leave the
remaining security in place, but this also allows us to remove the headers
customizations.
Polish login / logout

- Added messages for failed login and logout success
- Removed delete of JSESSIONID (this is done already when the session
  is invalidated). However, it may get created again immediately (i.e.
  by a JSP page)
- Add logout.permitAll() so that the logout and logout success URLs are
  granted access. This is important when a timeout occurs.
Merge pull request #31 from rwinch/polish-security

Polish security