Override the key to avoid CookieTheftException

[DevDengChao]

People may confused why those token.keyhash() not equals, for they forget to config the key twice.
So, override the key for them, make it more convenient to custom RememberMeServices.
See #4140;

[pivotal-issuemaster]

@XieEDeHeiShou Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

[pivotal-issuemaster]

@XieEDeHeiShou Thank you for signing the Contributor License Agreement!

[DevDengChao]

The CI says it cannot get a jar from spring repository and then stopped with error:

* What went wrong:
Could not resolve all files for configuration ':spring-security-messaging:optional'.
> Could not download spring-websocket.jar (org.springframework:spring-websocket:5.1.0.BUILD-SNAPSHOT:20180713.230306-259)
   > Could not get resource 'https://repo.spring.io/libs-snapshot/org/springframework/spring-websocket/5.1.0.BUILD-SNAPSHOT/spring-websocket-5.1.0.BUILD-20180713.230306-259.jar'.
      > Connection reset

I checked the file manually, exists.
Hope this pr could pass.

[eleftherias]

Thanks for the PR @XieEDeHeiShou! I have left some comments inline.
Additionally, please provide a test for this change.

[eleftherias]

Thanks @XieEDeHeiShou, I have left one comment about the code formatting.
Also, please add an additional test for the changes to remember me.

[eleftherias]

Thank you for the changes @XieEDeHeiShou. Please add a test for any changes in this PR.
Let me know if you need help with writing the test.

[DevDengChao]

@eleftherias I'd like to provide test cases for these changes, and I do need some help, can you please guide me?

[eleftherias]

@XieEDeHeiShou The new test will look very similar to getWhenRememberMeCookieThenAuthenticationIsRememberMeAuthenticationToken in the class RememberMeConfigurerTests.

The assertions will be the same, and only the configuration will change.
In the configuration of the new test we should set a custom rememberMeServices

.rememberMe()
	.rememberMeServices(rememberMeServices())

where rememberMeServices() can be an instance of TokenBasedRememberMeServices.

The key is that this new test should fail without the changes you have made, and pass when we add the changes from this PR.

I'm happy to provide any further guidance if you get stuck, or if this is unclear.

Additionally, I noticed an issue in the PR as it stands now, I left a comment inline.

[eleftherias]

Thanks for the quick turnaround again @XieEDeHeiShou. I have left a few more comments inline.

[eleftherias]

One more comment @XieEDeHeiShou

[eleftherias]

Is this change necessary? User.withDefaultPasswordEncoder is deprecated, but it is acceptable to use in tests.

[DevDengChao]

IDEA told me there is a warning when I commit this file, so I changed it. Should I revert this change?

[eleftherias]

Yes, please revert this change.
The IDE is correct to show a warning, but in this specific case it is allowed.

[DevDengChao]

Done

[eleftherias]

Thanks for the PR @XieEDeHeiShou! This is now merged into master.