Fixed by using `WebSecurityConfiguration` to detect existing security configuration (not the annotation). Fixes gh-151
