AuthzAuthenticationFilter supports client authentication based on client_id/client_secret parameters.
If the client_id or clientAuthenticationManager is null, no client authentication will be attempted(backwards compatible)

The UaaRequestMatcher now prints its name during debug logging. This is immensly helpful to understand what matcher actually had a match.

oauth-endpoints.xml must be evaluated after login-server-security.xml if we are to give Login Server first dibs to match /oauth/token requests.