Make OAuth2SsoConfigurer more granular

so it can support additive request matchers (instead of
the default HttpSecurity behaviour of overriding previous
calls with each call to antMatchers(...)). This allows us
to, for instance, ensure that the login URL always defaults
to /login.

Fixes gh-9