Disable anonymous auth for resource server
Ensure AccessDeniedException is thrown from expression handler

... otherwise the AccessDeniedHandler doesn't get a chance to send
the proper response and user just sees 500 status

Fixes gh-118
Support for Jackson2 in JdbcClientDetailsService
Fix potential duplicate token problem in JdbcTokenStore

It shouldn't happen in practice, but the JdbcTokenStore, since it
didn't check for the existence of a token with the same value
before doing an insert, might break confusingly later. I think
I would recommend a uniqueness constraint in the database anyway
but now we have a "last one wins" rule.
Add support for authorization code services in @Configuration