Upgrading from 0.6 to 0.7.0

The following should help most casual users of the project update their applications:

• UserDetails now has two extra methods. Most people who have extended Acegi Security's default User implementation of UserDetails will be fine, as the constructor sets sensible defaults for the extra methods. People who have written their own UserDetails implementation from scratch will need to add the additional two methods. Returning true to both methods will normally be correct.
• AutoIntegrationFilter has been removed. User should instead use HttpSessionIntegrationFilter (in most cases), or HttpRequestIntegrationFilter (if using most container adapters) or JbossIntegrationFilter (if using the JBoss container adapter).
• MethodDefinitionMap, which is usually used by MethodSecurityInterceptor for its objectDefinitionSource property, has been changed. From 0.7.0, when MethodDefinitionMap is queried for configuration attributes associated with secure MethodInvocations, it will use any method matching in the method invocation class (as it always has) plus any method matching any interface the MethodInvocation class directly implements. So consider a PersonManager interface, a PersonManagerImpl class that implements it, and a definition of PersonManager.findAll=ROLE_FOO. In this example, any query for either PersonManager.findAll OR PersonManagerImpl.findAll will return ROLE_FOO. As we have always encouraged definition against the interface names (as per this example), this change should not adversely impact users. This change was necessary because of the new MethodDefinitionSourceAdvisor (see below). Refer to the MethodDefinitionMap JavaDocs for further clarification.
• MethodDefinitionSourceAdvisor can now be used instead of defining proxies for secure business objects. The advisor is fully compatible with both MethodDefinitionMap and MethodDefinitionAttributes. Using an advisor allows caching of which methods the MethodSecurityInterceptor should handle, thus providing a performance benefit as MethodSecurityInterceptor is not called for public (non-secure) objects. It also simplifies configuration.
• MethodSecurityInterceptor has moved from net.sf.acegisecurity.intercept.method.MethodSecurityInterceptor to net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor. A simple find and replace will suffice to update your application contexts.
• All of the EH-CACHE cache implementations provided with Acegi Security have now been refactored to use a net.sf.ehcache.Cache obtained from EhCacheManagerFactoryBean, which is included with Spring 1.1.1 and above. See http://opensource.atlassian.com/confluence/spring/display/DISC/Caching+the+result+of+methods+using+Spring+and+EHCache for more about this bean, or the Contacts sample application for how to configure the EH-CACHE implementations provided with Acegi Security. Note the "cache" property is now required, and the old internally-managed cache properties have been removed.