title: How to protect the same resource using both spring-session and spring-security-oauth
body: <p>I have a requirement to use two kinds of authentication,
  for web we @EnableRedisHttpSession and for other consumers like mobile we use @EnableAuthorizationServer with @EnableResourceServer.</p>
  
  <p>suppose we try to protect a controller common to both the authentication mechanisms for e.g /api/v1/test </p>
  
  <p>i have hit a roadblock.
  i am only able to use one kind of authentication scheme
  if i set @WebSecurityConfigurerAdapter @order(2) and @ResourceServerConfigurerAdapter @order(3) then i can only access the resource via web</p>
  
  <p>and if i set @ResourceServerConfigurerAdapter @order(2) and @WebSecurityConfigurerAdapter @order(3) then only OAuth works.</p>
  
  <p>i am unable to use both the mechanism at the same time.how can we make the two work together, for e.g if the request comes from web use the filter responsible for that and if the request comes from mobile use the appropriate filter. web uses cookies and API Consumers use Authorization : Bearer header.</p>
  
  <p>please help</p>