Allow SSL enforcement for OAuth2 provider to be configurable

Make enforcing of SSL configurable, so it easier to test oauth in environments were SSL is not required.