anchor.diff:  === Web Security Expressions
   To use expressions to secure individual URLs, you would first need to set the `use-expressions` attribute in the `<http>` element to `true`.
   Spring Security will then expect the `access` attributes of the `<intercept-url>` elements to contain Spring EL expressions.
  -The expressions should evaluate to a boolean, defining whether access should be allowed or not.
  +The expressions should evaluate to a Boolean, defining whether access should be allowed or not.
   For example:
   
   [source,xml]
  
positive.code: == CORS
  
  Spring Framework provides http://docs.spring.io/spring/docs/current/spring-framework-reference/htmlsingle/#cors[first class support for CORS].
  CORS must be processed before Spring Security because the preflight request will not contain any cookies (i.e. the `JSESSIONID`).
  If the request does not contain any cookies and Spring Security is first, the request will determine the user is not authenticated (since there are no cookies in the request) and reject it.
  
  The easiest way to ensure that CORS is handled first is to use the `CorsFilter`.
  
negative.code: 
  To use this tag there must also be an instance of `WebInvocationPrivilegeEvaluator` in your application context. If you are using the namespace, one will automatically be registered. This is an instance of `DefaultWebInvocationPrivilegeEvaluator`, which creates a dummy web request for the supplied URL and invokes the security interceptor to see whether the request would succeed or fail. This allows you to delegate to the access-control setup you defined using `intercept-url` declarations within the `<http>` namespace configuration and saves having to duplicate the information (such as the required roles) within your JSPs. This approach can also be combined with a `method` attribute, supplying the HTTP method, for a more specific match.
  
  The Boolean result of evaluating the tag (whether it grants or denies access) can be stored in a page context scope variable by setting the `var` attribute to the variable name, avoiding the need for duplicating and re-evaluating the condition at other points in the page.
  
  
  ==== Disabling Tag Authorization for Testing
  