Ensure even if token request asks for more scopes they are not granted

Only approved scopes should make it into the access token, but this constraint
was being broken by the AuthorizationCodeTokenGranter, inadvertently because
of the implementation of OAuth2Request.createOAuth2Request(). Since that method
is actually only called from one place it seems safe to just change it so that
only the explicitly approved scopes are in the result.

Fixes gh-151
Add default ImplicitGrantService to ImplicitTokenGranter

Beware though: in a real server it has to be the *same* instance as held
by the AuthorizationEndpoint. Not ideal, maybe calls for some refactoring
later.
Add @Configuration support

Auth server, resource server and client are all represented in Java config
here. Simple test case provided for each.

Still work in progress but here's at least something that works for sparklr
and tonr use cases.

Work started in gh-139