Upgrade Spring
Fix name of TokenServices implementation

Fixes gh-150
Fix format of toString() when sessionId is null
Ensure even if token request asks for more scopes they are not granted

Only approved scopes should make it into the access token, but this constraint
was being broken by the AuthorizationCodeTokenGranter, inadvertently because
of the implementation of OAuth2Request.createOAuth2Request(). Since that method
is actually only called from one place it seems safe to just change it so that
only the explicitly approved scopes are in the result.

Fixes gh-151
Add default ImplicitGrantService to ImplicitTokenGranter

Beware though: in a real server it has to be the *same* instance as held
by the AuthorizationEndpoint. Not ideal, maybe calls for some refactoring
later.
Add @Configuration support

Auth server, resource server and client are all represented in Java config
here. Simple test case provided for each.

Still work in progress but here's at least something that works for sparklr
and tonr use cases.

Work started in gh-139
Convert oauth2 samples to Java config
Ignore missing web.xml
Rename Test* to *Tests

(Consistent with other Spring projects)

Fixes gh-153
More care with proxies in @Configuration

Apparently the rule of thumb is: if a @Bean uses a configurer
to grab one of it's dependencies then it should be a lazy proxy
in case it is used before the configurer has initialized.

In addition we find that an Application.class that extends
OAuth2AuthorizationServerConfigurerAdapter directly is problematic,
but if you nest it it works fine. Problems manifest themselves in
objects that ought to be proxies not being proxied (i.e. early
instantiation going on somewhere). This has no impact on
Spring OAuth (yet), but it affects applications that use it.
Fix typo in login.jsp
Extract /token security into base class
Fix integration test from command line
Merge remote-tracking branch 'upstream/master'

Conflicts:
	samples/oauth2/tonr/src/main/webapp/index.jsp