If SpEL expressions return an authorization manager, then this unifies the way that custom web and method security rules are described as both can now be based on the same bean.