Add OrderedHiddenHttpMethodFilter and use it in WebMvcAutoConfiguration
to ensure that it is applied before Spring Security.

Fixes gh-2773