HttpSecurityConfiguration applies all defaults

HttpSecurity headers is off by default and relies on
HttpSecurityConfiguration to enable it. This is more consistent with the
other operators

config/src/test/java/org/springframework/security/config/web/server/HttpSecurityTests.java

@@ -56,7 +56,7 @@ public class HttpSecurityTests {
 
 	@Before
 	public void setup() {
-		this.http = HttpSecurity.http();
+		this.http = HttpSecurity.http().headers().and();
 	}
 
 	@Test