SEC-2223: Correct FirewalledRequest#reset() javadoc
SEC-2197: Allow multiple invocations on HttpSecurity

Previously invoking methods like HttpSecurity#authorizeUrls() multiple
times would override one another. This has now changed to be more
intuitive. Initially this was required for the way that defaults were
provided so that they could be overriden, but this is no longer the case.