Allow /health and /info to authenticate anonymously

Then we can optionally find a non-anonymous principal if there
is one. If the user is anonymous then the health result is cached
up to endpoints.health.ttl (default 1000ms) to prevent a DOS attack.

Fixes gh-1353

spring-boot-samples/spring-boot-sample-actuator/src/main/java/sample/actuator/SampleActuatorApplication.java

@@ -17,6 +17,8 @@
 package sample.actuator;
 
 import org.springframework.boot.SpringApplication;
+import org.springframework.boot.actuate.health.Health;
+import org.springframework.boot.actuate.health.HealthIndicator;
 import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.context.annotation.ComponentScan;
@@ -26,10 +28,15 @@ import org.springframework.context.annotation.Configuration;
 @EnableAutoConfiguration
 @EnableConfigurationProperties
 @ComponentScan
-public class SampleActuatorApplication {
+public class SampleActuatorApplication implements HealthIndicator {
 
 	public static void main(String[] args) throws Exception {
 		SpringApplication.run(SampleActuatorApplication.class, args);
 	}
 
+	@Override
+	public Health health() {
+		return Health.up().withDetail("hello", "world").build();
+	}
+
 }

spring-boot-samples/spring-boot-sample-actuator/src/main/resources/application.properties

@@ -1,5 +1,5 @@
 logging.file: /tmp/logs/app.log
-logging.level.org.springframework.security: INFO
+logging.level.org.springframework.security: DEBUG
 management.address: 127.0.0.1
 #management.port: 8181
 endpoints.shutdown.enabled: true

spring-boot-samples/spring-boot-sample-actuator/src/test/java/sample/actuator/SampleActuatorApplicationTests.java

@@ -132,6 +132,17 @@ public class SampleActuatorApplicationTests {
 		assertEquals(HttpStatus.OK, entity.getStatusCode());
 		assertTrue("Wrong body: " + entity.getBody(),
 				entity.getBody().contains("\"status\":\"UP\""));
+		assertFalse("Wrong body: " + entity.getBody(),
+				entity.getBody().contains("\"hello\":\"1\""));
+	}
+
+	@Test
+	public void testSecureHealth() throws Exception {
+		ResponseEntity<String> entity = new TestRestTemplate("user", getPassword()).getForEntity(
+				"http://localhost:" + this.port + "/health", String.class);
+		assertEquals(HttpStatus.OK, entity.getStatusCode());
+		assertTrue("Wrong body: " + entity.getBody(),
+				entity.getBody().contains("\"hello\":1"));
 	}
 
 	@Test