Nest the @EnableWebSecurity so it can be added to a condition