Limit csrf disable to just shutdown actuator

[philwebb]

[mbhave]

We need management.endpoints.web.base-path for that and that would mean actuator specific code in the regular security auto-config which we don't want.