protected WebSecurityManager createDefaultSecurityManager() {
        return new DefaultWebSecurityManager();
    }
A fallback mechanism called in {@link #onFilterConfigSet()} to ensure that the
{@link #getSecurityManager() securityManager} property has been set by configuration, and if not,
creates one automatically.
web/src/main/java/org/apache/shiro/web/servlet/AbstractShiroFilter.java