title: How to disable security on actuator endpoints on spring boot 1.5 with spring security
body: <p>I have a Spring Boot application with secure API on port 8080, using <code>@EnableWebSecurity</code> annotation. The management port is changed to 8081 and is not exposed to the public so I don't need/want to have security enabled on the actuator endpoints</p>
  
  <p>On Spring Boot 1.4 it was possible to use property <code>management.security.enabled=false</code> to ignore all actuator endpoints from security. I understand that this functionality was considered a "mistake", and Boot 1.5 "corrects" this by removing this auto-configuration if <code>@EnableWebSecurity</code> is present. The release notes state that we have to explicitly configure this ourselves in this case.</p>
  
  <p>Does this mean we have to pull this out of 1.4 source and implement in each app, or is there a new way of achieving this?</p>