anchor.diff:  </filter-security-metadata-source>
   ----
   
  +[[m3to4-deprecations-config-http-adp]]
   ==== http@access-denied-page
   The XML attribute `http@access-denied-page` was removed in favor of <<nsa-access-denied-handler-error-page,access-denied-handler@error-page>>.
   This means if you have something like this:
  
positive.code:     new RememberMeAuthenticationFilter(authenticationManager,rememberMeServices);
  ----
  
  ==== TokenBasedRememberMeServices
  
  `TokenBasedRememberMeServices` default constructor and the `setKey` and `setUserDetailsService` methods were removed in favor of constructor injection.
  
negative.code: SecurityExpressionHandler<FilterInvocation> handler = ...
  ----
  
  [[m3to4-role-prefixing]]
  == Automatic ROLE_ prefixing
  
  Spring Security 4 made the use of ROLE_ consistent.
  