What was done for HttpSecurity with #6812 should also get implemented for HttpServerSecurity so that we'd get functional parity with webflux configuration classes.