Issue title: UI unable to render actuator responses
 Issue body: I am using SBA 2.0.1. The UI is unable to render data due to malformed JSON for certain actuator endpoints. The client applications are secured, and the admin server is properly configured to pass required headers to access the actuator endpoints. For example, SBA is able to successfully get response for `loggers` endpoint (please see attached loggers_response_actual.json). You will see in the json, a new object  is introduced as below:
```
{"error":"invalid_token","error_description":"G48y3EOMflfRwmvODgs65oizT7sP"}
```
I am sure this object is not coming from SBA, but there still seems something is not correct as the screenshot suggests that the API call was successful (status 200). Also i have attached the actual response for `loggers` endpoint when hitting it from postman.


![loggers_tab](https://user-images.githubusercontent.com/16265134/42389231-a318c8f0-8165-11e8-9746-a112ea99655e.JPG)

[loggers_response_postman.txt](https://github.com/codecentric/spring-boot-admin/files/2171181/loggers_response_postman.txt)
[loggers_response_actual.txt](https://github.com/codecentric/spring-boot-admin/files/2171182/loggers_response_actual.txt)



 Comments: 
 Comment 0: I guess the extra bit at the end is from some kind of middleware/firewall. The HTTP response status may be 200 but the returned content is not compliant to the JSON spec so the ui can't parse the content - there is nothing we can do about it - you need to fix your setup.
May be you should take some tcp dumps on your client and spring boot admin machine to figure out if there is something in between messing with the response
 Comment 1: I did some investigation and found that the extra JSON element was added by our internal security library. I was able to get UI working by excluding calls from admin UI to admin server using below configuration:
```
   /**
     * Ignoring all self-APIs/SBA server APIs which are called by SBA-UI internally.
     */
    @Override
    public void configure(final WebSecurity web) throws Exception {
        web.ignoring()
           .antMatchers(HttpMethod.OPTIONS)
           .antMatchers(HttpMethod.GET, "/**/applications", "/**/applications/*", "/**/notifications/*", "/**/instances/**");
    }
```
However, it would be good to call these endpoints securely too. I will raise a feature request for the same.
{'source': 'GithubIssues', 'repo_name_with_owner': 'codecentric/spring-boot-admin', 'issue_id': 338994923, 'repo_stars': 11301.0}