Remove authorization header that is not needed
Secure login server resources with oauth.login
Add an authentication manager that simply looks at scopes of an oauth token
Configure login-server-security.xml /oauth/token?grant_type=password
[#70693782]
https://www.pivotaltracker.com/story/show/70693782
Merge branch 'feature/scope_authentication_manager' into develop