update basic, apikey and simple web token security handler to be enabled by default

[stevehu]

This will ensure that the security is turned on whenever the handler is in the request/response chain so that security is not bypassed accidentally. When UnifiedSecurityHandler is used, we check this flag to call the security handler if enabled.