In particular don't assume that Spring Security Web is on the
classpath, just because Spring Security Core is.

Fixes gh-363