title: Spring Security - Anonymous Authentication - HttpSessionRequestCache
body: <p>Please help me on this.  </p>
  
  <p><code>void setCreateSessionAllowed(boolean createSessionAllowed)</code><br>
  method of </p>
  
  <p><code>org.springframework.security.web.savedrequest.HttpSessionRequestCache</code> 
  class says</p>
  
  <p><em>If true, indicates that it is permitted to store the target URL and exception information in a new HttpSession (the default). In situations where you do not wish to unnecessarily create HttpSessions - because the user agent will know the failed URL, such as with BASIC or Digest authentication - you may wish to set this property to false.</em></p>
  
  <p>So I did not understand the description properly, also we are using a product and its documentation says setting it to false will disable the creation of anonymous user sessions. 
  So my question is, session creation  and associating it with a request is servlet container's job. So How come using this method(setCreateSessionAllowed) will not create a session. 
  <strong>Please validate my understanding, is it correct or not. also</strong></p>
  
  <p><strong><code>setCreateSessionAllowed(false)</code>, will JSESSIONID be created or not?</strong></p>