SEC-2331: Cache Control now includes Expires: 0
SEC-2246: HttpSessionRequestCache.getRequest casts to RequestCache

The method getRequest use to cast to DefaultRequestCache, but this
is not necessary.

Now the cast is to SavedRequest.
SEC-2311: LogoutConfigurer allows other HTTP methods if CSRF is disabled
SEC-2304: rm duplicate MethodExpressionHandler from GlobalMethodSecurityConfiguration
SEC-2329: Allow injecting of AuthenticationTrustResolver
SEC-2329: JC @Autowire(required=false) AuthenticationTrustResolver

Java Configuration now allows optional @Autowire of
AuthenticationTrustResolver. In the WebSecurityConfigurerAdapter this is
done by populating AuthenticationTrustResolver as a sharedObject.
SEC-2301: GlobalMethodSecurityConfiguration sets DefaultWebSecurityExpressionHandler BeanResolver