finished backend spec implementation: oauth2 server, user management, avatar management, access control management, play2 client, standalone json api server using play2 with data validation