I've noticed something a number of times before, but never really cleaned it up: org.apache.shiro.web.DefaultWebSecurityManager should be in the org.apache.shiro.web.mgt package if it is to mirror core's package structure.
Similarly org.apache.shiro.web.WebUtils org.apache.shiro.web.RedirectView org.apache.shiro.web.SavedRequest org.apache.shiro.web.WebSecurityManager should probably be moved to the correct respective package locations to mirror core. I think this should be done before 1.0 or we'll be permanently stuck with where they are now. Any objections? - Les
