rel #6118 switching from xml to java based web security configuration