Change XML default use-authorization-manager="true"

[rwinch]

We should switch the default of XML authorization to true. When doing so, update DeferHttpSessionXmlConfigTests xml configuration to remove explicitly configured use-authorization-manager="true".