I had the same issue, try to replace http.csrf().disable() by http.csrf(AbstractHttpConfigurer::disable); and then you can keep your original conf.
http.csrf().disable()
http.csrf(AbstractHttpConfigurer::disable);