引用
create-session Controls the eagerness with which an HTTP session is created by Spring Security classes. Options include:
always - Spring Security will proactively create a session if one does not exist.如果当前不存在session，SpringSecurity会自动创建一个
ifRequired - Spring Security will only create a session only if one is required (default value).只有在required的时候，SpringSecurity才会创建一个session。
never - Spring Security will never create a session, but will make use of one if the application does.SpringSecurity不会自动创建session，但是会尝试使用已经存在的session，这里的session可能是由webapp本身创建的。
stateless - Spring Security will not create a session and ignore the session for obtaining a Spring Authentication.SpringSecurity永远不会创建也不会使用session
always - Spring Security will proactively create a session if one does not exist.如果当前不存在session，SpringSecurity会自动创建一个
ifRequired - Spring Security will only create a session only if one is required (default value).只有在required的时候，SpringSecurity才会创建一个session。
never - Spring Security will never create a session, but will make use of one if the application does.SpringSecurity不会自动创建session，但是会尝试使用已经存在的session，这里的session可能是由webapp本身创建的。
stateless - Spring Security will not create a session and ignore the session for obtaining a Spring Authentication.SpringSecurity永远不会创建也不会使用session