Add a load of integration tests

Authcode tests still fail, but they look like mostly client
configuration issues.

Biggest compromise at the moment is that we had to set security.user.password
and hard code th evalue in 2 places. Spring Boot wants to default the "global"
AuthenticationManager, but Spring Security wants to keep that a secret still
(and we need it in the password grant).