anchor.diff:  * `org.springframework.security.web.util.RequestMatcherEditor` -> `org.springframework.security.web.util.matcher.RequestMatcherEditor`
   * `org.springframework.security.web.util.RegexRequestMatcher` -> `org.springframework.security.web.util.matcher.RegexRequestMatcher`
   
  +[[m3to4-deprecations-web-wseh]]
   ==== WebSecurityExpressionHandler
   
   `WebSecurityExpressionHandler` was removed in favor of using `SecurityExpressionHandler<FilterInvocation>`.
  
positive.code: </http>
  ----
  
  ==== http@path-type
  The XML attribute `http@path-type` was removed in favor of <<nsa-http-request-matcher,http@request-matcher>>.
  This means if you have something like this:
  
negative.code: CompositeSessionAuthenticationStrategy strategy = new CompositeSessionAuthenticationStrategy(delegates);
  ----
  
  [[m3to4-deprecations-web-sfps]]
  ==== SessionFixationProtectionStrategy
  
  `SessionFixationProtectionStrategy` removed `setRetainedAttributes` method in favor of users subclassing `SessionFixationProtectionStrategy` and overriding `extractAttributes` method.
  
  [[m3to4-deprecations-web-baf]]
  ==== BasicAuthenticationFilter
  
  `BasicAuthenticationFilter` default constructor and the `setAuthenticationManager` and `setRememberMeServices` methods were removed in favor of constructor injection.
  