Extract actuator security into separate classes

So spring-security + a web app is secure by default
(you don't need the actuator).