Adjust security.basic.enabled=false behaviour

Actually the web-secure sample is misusing
security.basic.enabled=false (IMO) - it should be a flag
to say that you want to temporarily disable the basic security
fallback on application endpoins, not  way to disable all
security autoconfiguration.

Added test case to web-secure sample to ensure a user
can log in.

Fixes gh-979

spring-boot-samples/spring-boot-sample-web-secure/src/main/resources/application.properties

@@ -1,3 +1,5 @@
 spring.thymeleaf.cache: false
 debug: true
-security.basic.enabled: false
+security.basic.enabled: false
+# demo only:
+security.user.password: password

spring-boot-samples/spring-boot-sample-web-secure/src/main/resources/templates/login.html

@@ -27,7 +27,7 @@
 				</fieldset>
 				<input type="submit" id="login" value="Login"
 					class="btn btn-primary" /> <input type="hidden"
-					th:name="${_csrf.parameterName}" th:value="${_csrf.token}" />
+					th:name="${_csrf.parameterName}" th:value="${_csrf.token}" th:if="${_csrf}"/>
 			</form>
 		</div>
 	</div>