the security itself does not require http-foundation 2.4. the changes here did not use a http-foundation 2.4 feature. it only requires http-kernel 2.4 (which itself requires foundation 2.4. anyway, but the security doesn't need it).