private void ensureSecurityManager() {
        WebSecurityManager securityManager = getSecurityManager();
        if (securityManager == null) {
            LOGGER.info("No SecurityManager configured.  Creating default.");
            securityManager = createDefaultSecurityManager();
            setSecurityManager(securityManager);
        }
    }
A fallback mechanism called in {@link #onFilterConfigSet()} to ensure that the
{@link #getSecurityManager() securityManager} property has been set by configuration, and if not,
creates one automatically.
web/src/main/java/org/apache/shiro/web/servlet/AbstractShiroFilter.java