Add TokenExtractor strategy to OAuth2AuthenticationProcessingFilter

Completes the server-side component and ixes gh-136
Fix a couple of integration tests