Don't use session scope for RestTemplate

The implementation of `<oauth:rest-template/>` was fine, but the advice
in `@EnableOAuth2Client` was to use session scope for the `RestTemplate`
which is not a great idea since it is not serializable (and has properties
that cannot be controlled). Better to put the `OAuth2ClientContext` in
session scope.

Fixes gh-235