AuthzAuthenticationFilter supports client authentication based on client_id/client_secret parameters.
If the client_id or clientAuthenticationManager is null, no client authentication will be attempted(backwards compatible)

The UaaRequestMatcher now prints its name during debug logging. This is immensly helpful to understand what matcher actually had a match.

oauth-endpoints.xml must be evaluated after login-server-security.xml if we are to give Login Server first dibs to match /oauth/token requests.

Reordering of login-server-security.xml and oauth-endpoints.xml does not yield any conflicts per table below
oauth-endpoints.xml                                             login-server-security.xml
/oauth/token with Authorization: Bearer                         /oauth/token source=login&grant_type=password&add_new=
/oauth/token with any match
/oauth/authorize response_type=token&source=credentials         /oauth/authorize source=login
/oauth/authorize response_type=token&credentials={              /oauth/authorize login={