title: Injecting NullAuthenticatedSessionStrategy in spring security 4.0.1
body: <p>I am migrating an existing application using spring-security 3.1.3 to 4.0.1. In the current code I see NullAuthenticatedSessionStrategy used as below</p>
  
  <pre><code>&lt;sec:http&gt;
  ..
  &lt;sec:session-management session-authentication-strategy-ref="ss"/&gt;
  &lt;/sec:http&gt;
  &lt;bean id="ss" class="org.springframework.security.web.authentication.session.NullAuthenticatedSessionStrategy"/&gt;
  </code></pre>
  
  <p>In our migrated code for 4.0.1 spring security, if i leave the same, it seems the SessionFixationProtectionStrategy is used. So i have switched off the protection using session-fixation-protection=none. </p>
  
  <pre><code>&lt;sec:session-management session-fixation-protection="none"/&gt;
  </code></pre>
  
  <p>Q-1;
  Here i am not clear what is the difference in using NullAuthenticatedSessionStrategy vs that of switching off the protection as above.</p>
  
  <p>Q-2;
  If i still want to use NullAuthenticatedSessionStrategy as in my current code, how to do that in 4.0.1? </p>
  
  <p>Thanks </p>