Fix bug in GroovyTemplate convenience

It was ignoring the engine argument in the 3 arg version
of template().
Switch basic auth back on in web-secure

Setting security.basic.enabled=false in a secure
app doesn't make a lot of sense. The sample has it
set to true now (the default) so users can login
(via the form that is sitting in front of the
basic auth filter chain).

Fixes gh-997
Merge remote-tracking branch 'origin/1.0.x'