Add a @EnableWebSecurity if it looks like the user needs one

If the user explicitly disables the basic security features and forgets to
@EnableWebSecurity, and yet still wants a bean of type
WebSecurityConfigurerAdapter, he is trying to use a custom
security setup and the app would fail in a confusing way without
this change.

Fixes gh-568

spring-boot-samples/spring-boot-sample-web-secure/src/main/resources/application.properties

@@ -1,2 +1,3 @@
 spring.thymeleaf.cache: false
-debug: true
+debug: true
+security.basic.enabled: false