GPII-1050: Some OAuth2 Express clean-up

- Address deprecation warnings
- Apply the body-parser at sites of usage rather than globally
GPII-17: First working driver for OAuth2-protected CBFM - this verifies just the very first stage of the interaction which issues a redirect to the URL /login - some hacks in the test driver for detecting top level executable since some machinery was omitted from GPII test driver
GPII-17: Use authServer.standalone in singleProcessAuthServer
GPII-17: Use session and passport middleware at routes rather than globally
GPII-17: Move OAuth2 sample data to /examples
GPII-17: Updated to newer version of Kettle - "requestOptions" has been removed from all kettle.test.request.http etc. as well as duplication caused by URL expander grade names. Cloud-based acceptance tests have been rationalised to simply provide solutionId value rather than the previous bizzare URI-encoded literal JSON. Removed last literal references to KettleTestUtils path. OAuth2 tests have now got as far as the "authorization decision" request - details for this now need to be filled in. Some improved commenting and diagnostics, proper 401 status code on trying to access FlowManager without a session.
Merge remote-tracking branch 'BBATES/GPII-17' into GPII-17
Merge branch 'GPII-17' into GPII-1036