added actuate plugin so http://.../health etc works. Fails to limit the sensitive ones by application.properties. It seems to be fine but is not read.
various
Login page, and CSRF workaround.