title: DefaultWebSecurityExpressionHandler is always used
body: <p>I have a spring-boot web application that declares some security through this class:</p>
  
  <pre><code> @Configuration
   @EnableWebSecurity
   @Order(Ordered.LOWEST_PRECEDENCE - 50) // needs to be after SpringBootAuthenticationConfigurerAdapter to register default in memory user
   public class StorefrontSecurityConfig extends GlobalAuthenticationConfigurerAdapter {
  
       @Order(SecurityProperties.ACCESS_OVERRIDE_ORDER - 1)
       @Configuration
       public static class MyStorefrontSecurityConfig extends WebSecurityConfigurerAdapter {
         .....
       }
  </code></pre>
  
  <p>and it all works fine. I also add these annotations to some of my service methods:</p>
  
  <pre><code>@PreAuthorize("hasPermission(#entity, 'APPROVE') or hasPermission(#entity, 'ADMINISTRATION') or hasRole('ROLE_ADMINGROUP')")
  void approve(final EntityModificationEntityDefinition entity);
  
  @PreAuthorize("hasPermission(#entity, 'APPROVE') or hasPermission(#entity, 'ADMINISTRATION') or hasRole('ROLE_ADMINGROUP')")
  void reject(final EntityModificationEntityDefinition entity);
  </code></pre>
  
  <p>and for now they don't do much - which is perfectly fine. But now I create jar file with the following configuration:</p>
  
  <pre><code>@Configuration
  @EnableGlobalMethodSecurity(securedEnabled = true, jsr250Enabled = true, prePostEnabled = true)
  public class PersonalizationConfig extends GlobalMethodSecurityConfiguration {
  
  private final Logger LOG = LogManager.getLogger(getClass());
  
  /* Global Method Security */
  
  @Override
  public AccessDecisionManager accessDecisionManager() {
      final List&lt;AccessDecisionVoter&lt;? extends Object&gt;&gt; accessDecisionVoters = new ArrayList&lt;&gt;();
      accessDecisionVoters.add(new RoleVoter());
      accessDecisionVoters.add(new AuthenticatedVoter());
      accessDecisionVoters.add(new PreInvocationAuthorizationAdviceVoter(preInvocationAuthorizationAdvice()));
  
      final UnanimousBased accessDecisionManager = new UnanimousBased(accessDecisionVoters);
      accessDecisionManager.setAllowIfAllAbstainDecisions(true);
  
      return accessDecisionManager;
  }
  
  @Override
  protected MethodSecurityExpressionHandler createExpressionHandler() {
      return this.defaultMethodSecurityExpressionHandler();
  }
  </code></pre>
  
  <p>This jar has a <code>spring.factories</code> file in <code>META-INF</code> so that being a spring-boot application the <code>@Configuration</code> is loaded. Now I expect when I include this jar in the classpath to have the <code>@PreAuthorize</code> annotations to start working. However what I see is that <code>AbstractSecurityExpressionHandler</code> is invoked and it calls the abstract method <code>createSecurityExpressionRoot(authentication, invocation);</code> which always goes to <code>DefaultWebSecurityExpressionHandler</code> and never to the <code>DefaultMethodSecurityExpressionHandler</code>. I can see the <code>DefaultMethodSecurityExpressionHandler</code> is constructed when my application starts, so I'm really not sure what happens here.</p>
  
  <p>EDIT: Here's my <code>spring.factories</code> file:
  <code>
  org.springframework.boot.autoconfigure.EnableAutoConfiguration=com.nemesis.platform.module.personalization.core.config.PersonalizationConfig
  </code></p>