Add default request matcher to ResourceServerConfiguration

All resources apart from /oauth/** are protected by default. User can override
by extending ResourceServerConfigurerAdapter.