Add a load of integration tests

Biggest compromise at the moment is that we had to set security.user.password
and hard code th evalue in 2 places. Spring Boot wants to default the "global"
AuthenticationManager, but Spring Security wants to keep that a secret still
(and we need it in the password grant).