ShiroFilter does not work with proxied security manager

The ShiroFilter.isHttpSessions() method does an instanceof check on the security manager, checking whether it's an instance of DefaultWebSecurityManager.

This doesn't work when the security manager is a JDK proxy to a DefaultWebSecurityManager because the proxy implements the SecurityManager interface, which doesn't have the isHttpSessions() method.

Perhaps we should have a WebSecurityManager interface with the isHttpSessions() method defined on it?