anchor.diff:  ----
   @EnableGlobalMethodSecurity(prePostEnabled = true)
   ----
  -====
  -
  -changes to:
  +
  +.Xml
  +[source,xml,role="secondary"]
  +----
  +<global-method-security pre-post-enabled="true"/>
  +----
  +====
  +
  +and:
   
   ====
   .Java
  
positive.code: ----
  @EnableMethodSecurity
  ----
  ====
  
  For applications not using `prePostEnabled`, make sure to turn it off to avoid activating unwanted behavior.
  
  For example, a listing like:
  
  
negative.code: ----
  @EnableMethodSecurity(securedEnabled = true, prePostEnabled = false)
  ----
  
  .Xml
  [source,xml,role="secondary"]
  ----
  <method-security secured-enabled="true" pre-post-enabled="false"/>
  ----
  ====
  
  '''
  
  [[servlet-replace-permissionevaluator-bean-with-methodsecurityexpression-handler]]
  [%interactive]
  * [ ] Publish a `MethodSecurityExpressionHandler` instead of a `PermissionEvaluator`
  
  `@EnableMethodSecurity` does not pick up a `PermissionEvaluator`.
  This helps keep its API simple.
  
  If you have a custom {security-api-url}org/springframework/security/access/PermissionEvaluator.html[`PermissionEvaluator`] `@Bean`, please change it from:
  
  