Explcitly state in docs that Spring Security is required

... if you use management.security.* properties

Fixes gh-595