LifecycleBeanPostProcessor needs to be registred before ShiroFilterFactoryBean because...
ShiroFilterFactoryBean itself is a BeanPostProcessor, like LifecycleBeanPostProcessor too. So during AbstractApplicationContext.registerBeanPostProcessors() these two beans are created and added to nonOrderedPostProcessors, after then they get registered. At this execution point ShiroFilterFactoryBean is already created with its SecurityManager and defined Realms. So LifecycleBeanPostProcessor will not effect anymore on Realms init.