SECOAUTH-423: Add Serializable to support session scoped attributes
SECOAUTH-427: ensure redirect_uri is optional (if registered)
Add test for fixed registered redirect

The spec says that a redirect can be computed by the
auth server if one is registered for the client. Tonr
has 2 registrations and only one has a redirect.

In addition to testing that the redirect can be ommitted
we test that the URL that triggers the token acquisition
can be different than the registered URI (/trigger
and /redirect).