code: public Filter createFilter(FilterConfig filterConfig) {
          LOGGER.entering(SecurityRealm.class.getName(), "createFilter");
          
          Binding binding = new Binding();
          SecurityComponents sc = getSecurityComponents();
          binding.setVariable("securityComponents", sc);
          binding.setVariable("securityRealm",this);
          BeanBuilder builder = new BeanBuilder();
          builder.parse(filterConfig.getServletContext().getResourceAsStream("/WEB-INF/security/SecurityFilters.groovy"),binding);
          WebApplicationContext context = builder.createApplicationContext();
          return (Filter) context.getBean("filter");
      }
docs: Creates {@link Filter} that all the incoming HTTP requests will go through
  for authentication.
  
  <p>
  The default implementation uses {@link #getSecurityComponents()} and builds
  a standard filter chain from /WEB-INF/security/SecurityFilters.groovy.
  But subclasses can override this to completely change the filter sequence.
  
  <p>
  For other plugins that want to contribute {@link Filter}, see
  {@link PluginServletFilter}.
  
  @since 1.271