@Override
    protected SecurityManager createDefaultInstance() {
        return new DefaultWebSecurityManager();
    }
Simply returns <code>new {@link DefaultWebSecurityManager}();</code> to ensure a web-capable
{@code SecurityManager} is available by default.

@return a new web-capable {@code SecurityManager} instance.
web/src/main/java/org/apache/shiro/web/config/WebIniSecurityManagerFactory.java