How Spring Security uses the HttpSession method?