spring security - Order of Java Config SecurityBuilder's -

i'm developing web application unsing spring security 4.0.0's java config instead of xml config. i'm using objectpostprocessors customize of spring security's beans, notably session consurrency ones (to achive immediate invalidation of session user logs in again, opposed spring's standard behavior of invalidating @ next request).

it's working expected of times, when restart application seems not beans modified want.

are securitybuilders processed in specific order or instead processed ramdom order?

edit:

my config

@enablewebsecurity public class securityconfig extends abstractcaswebsecurityconfigureradapter {      public securityconfig() {         super(true, false, true);     }      @autowired     private environment env;      // need custom sessionregistry there's no way ahold of 1 created configurer.     @bean     public sessionregistry sessionregistry() {         return new sessionregistryimpl();     }      // need custom httpsessioncsrftokenrepository there's no way ahold of 1 created configurer.     @bean     public csrftokenrepository csrftokenrepository() {         return new httpsessioncsrftokenrepository();     }      // our custom concurrentsessioncontrolauthenticationstrategy invalidates session     @bean     public sessioninvalidatingconcurrentsessioncontrolauthenticationstrategy myconcurrentsessioncontrolauthenticationlistener()     {         // have recreate logouthandlers because need call them         // before invalidating session          final logouthandler [] logouthandlers = new logouthandler [] {                  new cookieclearinglogouthandler("jsessionid"),                 new csrflogouthandler(csrftokenrepository())                 //, new securitycontextlogouthandler() // seems create problems redirecting same page caused login request                 };             sessioninvalidatingconcurrentsessioncontrolauthenticationstrategy mine = new sessioninvalidatingconcurrentsessioncontrolauthenticationstrategy(sessionregistry(), logouthandlers);         mine.setexceptionifmaximumexceeded(false);         mine.setmaximumsessions(1);         return mine;     }      @override     public void configure(websecurity web) throws exception {         super.configure(web);          boolean devmode = this.env.acceptsprofiles("development");          final string [] ignoredpaths = devmode             ? new string [] {"/webjars/**", "/static/**", "/bower_components/**" }              : new string [] {"/webjars/**", "/static/**" };          web             .ignoring()                 .antmatchers(ignoredpaths)                 .and()             .debug(false)         ;     }      protected void configure(final httpsecurity http) throws exception {         super.configure(http);          http             .sessionmanagement()                 .maximumsessions(73467436)  // trigger concurrencycontrolconfigurer                     .sessionregistry(sessionregistry())                     .and()                 .withobjectpostprocessor(new objectpostprocessor<concurrentsessioncontrolauthenticationstrategy>() {                     @suppresswarnings("unchecked")                     @override                     public <o extends concurrentsessioncontrolauthenticationstrategy> o postprocess(o concurrentsessioncontrolas) {                         // substitute concurrentsessioncontrolauthenticationstrategy created                          // concurrencycontrolconfigurer our own                          return (o) myconcurrentsessioncontrolauthenticationlistener();                     }                 })                 .and()             // need ignore stomp endpoint allow sockjs javascript client issue post requests             // /push/../../.. when using trasports not websocket;             // @ time, protection given stomp csrf headers             .csrf()                 .csrftokenrepository(csrftokenrepository())                 .ignoringantmatchers("/push/**")                 .and()             // allow same origin frame our site support iframe sockjs             .headers()                 .frameoptions().sameorigin()                 .and()             .authorizerequests()                 .antmatchers("/help/**").permitall() // redirects not require authentication                 .antmatchers("/push/info").permitall() // not require being authenticated /info request sockjs                 .anyrequest().authenticated()                 .and()             // remove session cookie when logging out             .logout()                 .deletecookies("jsessionid") // see: http://docs.spring.io/autorepo/docs/spring-security/current/reference/htmlsingle/#detecting-timeouts                 .and()             ;      }   } 

abstractcaswebsecurityconfigureradapter abstractwebsecurityconfigureradapter configures cas.