title: spring.h2.console.settings.web-allow-others not working for me to disable access
body: <p>I am trying to set spring.h2.console.settings.web-allow-others=false so that the console is only available on the local machine. It works great if I run my application in IntelliJ, but as soon as I build  the jar and run it, this setting seems to have no effect and defaults to enabled.</p>
  
  <p>I don't believe I have any parameters being passed to the jar at startup, but I'm wondering if something else can override this settings.</p>
  
  <p>So I have the following in my application.properties.</p>
  
  <pre><code># H2
  spring.h2.console.enabled=true
  spring.h2.console.path=/h2
  #spring.h2.console.settings.web-allow-others=true
  </code></pre>
  
  <p>As this example shows it's commented out, which I expect to be default to false. I have tried uncommenting and setting to false, but no effect.
  I have tried using the H2 normal config value of webAllowOthers, but no effect.</p>
  
  <p>If I set spring.h2.console.enabled=false, I no longer am able to access the console.  I feel this shows that I'm at least editing the correct file.</p>
  
  <p>I do have a secondary test.properties used by our test cases, but i have tried setting to false and removing in that file as well.  I had thought that maybe last one in wins or something.</p>
  
  <p>I'm at a loss of other things to try, my only thought is a bug or some other config that can override these settings.</p>
  
  <p>I am using SpringBoot 2.0.0.RELEASE AND dB2 1.4.196</p>
  
  <p>UPDATE:  Upon further testing, it seems like it works fine if I build the jar and have console enabled and web-allow-others disabled.  But once I enabled web-allow-others once, it never blocks it again, even after web-allow-others=false</p>