在实际应用中觉得spring security的命名空间缺少两个元素：<!--[endif]-->
form-login 没有Post-only属性的配置，而UsernamePasswordAuthenticationFilter 源码中post默认为true
public class UsernamePasswordAuthenticationFilter extends
AbstractAuthenticationProcessingFilter {
public static final String SPRING_SECURITY_FORM_USERNAME_KEY = "j_username";
public static final String SPRING_SECURITY_FORM_PASSWORD_KEY = "j_password";
@Deprecated
public static final String SPRING_SECURITY_LAST_USERNAME_KEY = "SPRING_SECURITY_LAST_USERNAME";
private String usernameParameter = "j_username";
private String passwordParameter = "j_password";
private boolean postOnly = true;
why http 中提供了FilterSecurityInterceptor的accessDecisionManager和authenticationManager的配置，而不提供FilterInvocationSecurityMetadataSource的配置？？