This Web Flow sample was using DefaultWebSecurityExpressionHandler and stopped working after an upgrade to 7.0 for which I would need to add spring-security-access to the classpath. Before realizing that I tried DefaultHttpSecurityExpressionHandler instead, but got an IOException from AbstractAuthorizeTag on this line.