move to Spring 4.0.2

fixes #220.

Also update spring security to 3.2.0 due to errors with Spring 4. Must exclude transitive spring-security from spring oauth2