SECOAUTH-423: Add Serializable to support session scoped attributes
SECOAUTH-427: ensure redirect_uri is optional (if registered)
Add test for fixed registered redirect

The spec says that a redirect can be computed by the
auth server if one is registered for the client. Tonr
has 2 registrations and only one has a redirect.

In addition to testing that the redirect can be ommitted
we test that the URL that triggers the token acquisition
can be different than the registered URI (/trigger
and /redirect).
SECOAUTH-404: remove @Autowired
Removed readObject and writeObject from OAuth2Request (which no longer needs them)
Make shared fields private with protected setter
Add boolean flag to allow client authentication in request params
Small changes to support Spring 4
Made OAuth2RequestValidator pluggable through the xml authorization-server configuration.
Move new features to 1.1 xsd
Fix for client_id in req parm and auth header
Handle non-oauth2 errors similar to RestTemplate

Update OAuth2ErrorHander to handle non-oauth2 errors in a similar
same way that RestTemplate does.  Now, OAuth2ErrorHandler only looks
at 4XX status codes and if it is not able to determine a reasonable
oauth2 error, it delegates to a different/default ErrorHandler.
Fix code that wasn't using buffered response.

- Some code wasn't using the correct buffered response.
- Added test case to verify that custom ErrorHandlers can
consume the response body if needed.
change test cases to match updated error handling
Revert Spring 4 change to RestTemplate

The API changed slightly in the underlying library
which is a nightmare. I think the current code now
works with Spring 4 snapshots.