bumped oauth2 dependency to 2.1.4 because of CVE-2019-3778

[jameskhedley]

issue #1468

[jansinger]

The fixed DefaultRedirectResolver of Spring Security now does a strict path match as required, so that the non strict mode of the BlacklistAwareRedirectResolver does not work as expected anymore.
My suggestion would be to remove the non strict mode to comply with the security requirements, but this will break existing installations using this feature, especially those using the heart mode.

[jricher]

FWIW, Heart mode requires strict matching, and strict mode has been the default since 1.3.2 anyway with or without heart mode.

[jricher]

This pull request needs to fix the associated unit tests if it's to be included.