private void assertWebSecurityManager(SecurityManager sm) {
        if (!(sm instanceof WebSecurityManager)) {
            String msg = "SecurityManager instance must be a " + WebSecurityManager.class.getName() + " instance.";
            throw new IllegalStateException(msg);
        }
    }
Default {@link WebEnvironment} implementation based on a backing {@link Map} instance.

@since 1.2
web/src/main/java/org/apache/shiro/web/env/DefaultWebEnvironment.java