Internal to many of Spring Security's configuration classes is a technique for ensuring that it only uses beans with a unique instance in the application context.
Spring Framework's ObjectProvider exposes an API for this kind of thing and it would be interesting to see how many places we could replace this custom code using ApplicationContext#getBeanProvider.