Make initial app unsecured by not including spring-boot-starter-security

Resolves #12 by not introducing Boot's security autoconfiguration until the 'complete' phase