Question: How do I not instantiate Spring Security until I need to? 

I'm using Google App Engine so the startup time of my web app is important. Sometimes when a user requests a page, they must wait the whole time for my web app instantiate before getting a response (this is called a loading request). 

Certain pages of my app require no authentication. For these pages, if the request is a loading request, I don't want the user to have to wait the extra ~1.5 seconds for Spring Security to instantiate.

I've already figured out how to lazy load all of the other components of my app, Spring Security is the only one I don't know how. Anyone have an idea?

EDIT: If anyone knows how to instantiate Spring Security from code instead of using applicationContext-security.xml, then I think I could figure out how to lazy load it.

Answer: 
Well, I finally figured it out. I had to subclass `org.springframework.web.context.ContextLoaderListener` and `org.springframework.web.filter.DelegatingFilterProxy` to not do anything until I call an activate method on them.
You can configure `<url-pattern>`s of Spring Security filter mapping in `web.xml` to match the secured resources only (as well as login-logout pages and other resources which require the Spring Security processing), and wrap the default filter with your own lazy wrapper, as you did with `DispatcherServlet`.

**EDIT:**
The problem seems to be more complex than I thought. You can also try to define your security xml as `<beans default-lazy-init="true" ...>`