Remove parent directory path traversals in DefaultRedirectResolver

To prevent redirect matches in sibling and ancestor resources we need to
flatten the path when matching redirects. It's not a major vulnerability
especially since most registrations are in the form of a root resource,
but worth patching anyway. A similar bug contributed to a publicly revealed
hack on Github, but in the workds of the attacker "is not worth much on its
own".

Fixes gh-155
Add @EnableAuthorizationServer
Add @EnableResourceServer
Add @EnableOAuth2Client
Add JDBC support to @Enabled auth server
Logout link added to tonr's main page

Fixes gh-148
Fix broken link to OAuth 2.0 section
[maven-release-plugin] prepare release 2.0.0.M3
[maven-release-plugin] prepare for next development iteration
Add test for redirect with query params
Add user approval handler to default configuration

Fixes gh-156
Add query and fragment encoding to redirect URIs

Fixes gh-152
Rename frameworkEndpointMapping

Fixes gh-158
Support for custom headers in AccessTokenRequest
Delegate to DefaultResponseErrorHandler in OAuth2ContextSetup

OAuth2 requests in tests can fail in a number of ways, and the reason
a custom error handler is used in the OAuth2ContextSetup is so that
errors can be asserted (e.g. from status codes) and not just
blow up in the user's face. The problem with the old implementation
was that the custom error handler never threw an exception, so it
would cause the RestTemplate that wraps it to drop down to attempt
to extract a response body, even if it has aleady been done (to
construct the OAuth2Exception from the resource server), leading
to a new RestClientException that essentially masks the original
problem. The solution is to delegate to the DefaultResponseErrorHandler
which always throws an exception as the last resort (instead of
simply doing nothing).
Add default request matcher to ResourceServerConfiguration

All resources apart from /oauth/** are protected by default. User can override
by extending ResourceServerConfigurerAdapter.
Add tokenServices() to OAuth2*Configurers

Fixes gh-154
Support refresh token by default
Integrate endpoint mappings with @Configuration helpers

Users can now easily change the endpoint paths from their defaults,
e.g. /oauth/token->/token.
Make form authentication for clients optional