The HttpServletRequestListener has been removed as part of

But this issue means that security interceptors relying on HttpServletRequestListener are completely non-functional in 2.7.0.CR3 release.