Add TokenExtractor strategy to OAuth2AuthenticationProcessingFilter

Completes the server-side component and fixes gh-136
Fix a couple of integration tests