Fix password grant in security sample

We need to add a workaround for a Spring Boot issue (fixed in
1.1.9). The AuthenticationManager supplied by Spring Boot gets
created too early and injected into out OAuth2 server, unless we
defer it a bit by making it a lazy implementation that initializes
itself only when used.

Fixes gh-2