Spel security fix; fixes gh-917

docs/src/main/asciidoc/spring-cloud-sleuth.adoc

@@ -294,7 +294,9 @@ Precedence is:
 
 - try with the bean of `TagValueResolver` type and provided name
 - if one hasn't provided the bean name, try to evaluate an expression. We're searching for a `TagValueExpressionResolver` bean.
-The default implementation uses SPEL expression resolution.
+The default implementation uses SPEL expression resolution. If we do not find any expression to evaluate, return the `toString()`
+value of the parameter.
+**IMPORTANT** You can only reference properties from the SPEL expression. Method execution is not allowed due to security constraints.
 - if one hasn't provided any expression to evaluate just return a `toString()` value of the parameter
 
 ==== Custom extractor
@@ -950,4 +952,4 @@ class ReporterConfiguration {
 You can find the running examples deployed in the https://run.pivotal.io/[Pivotal Web Services]. Check them out in the following links:
 
 - http://docssleuth-zipkin-server.cfapps.io/[Zipkin for apps presented in the samples to the top]
-- http://docsbrewing-zipkin-server.cfapps.io/[Zipkin for Brewery on PWS], its https://github.com/spring-cloud-samples/brewery[Github Code]
+- http://docsbrewing-zipkin-server.cfapps.io/[Zipkin for Brewery on PWS], its https://github.com/spring-cloud-samples/brewery[Github Code]