SECOAUTH-361: Allow user to inject AuthenticationDetailsSource into <oauth:resource-server/>

Also fixed TestOAuth2ClientContextFilter test case
SECOAUTH-318: Add denyAll() catch all to token admin endpoints
SECOAUTH-142: make session peristed tokens optional
SECOAUTH-383: fix iterator logic for multi-valued parameters