The implementation (introduced by
2084f33a) was to permissive and posed a
security risk. As a consequence, cross origin requests requiring client
authentication are no longer possible.

The config parameter is now used instead of the hard-coded value '5'.

All feature settings are replaced by the received object so the use of
PATCH does not make sense here. The session is "patched" but the HTTP
verb always relates to the URL which refers explicitly to features in
this case.

See https://tools.ietf.org/html/rfc5789.

This upgrades Spring Framework to version 4.2.

See http://docs.spring.io/spring/docs/current/spring-framework-reference/htmlsingle/#new-in-4.2.