The Acegi documentation here:

http://www.acegisecurity.org/guide/springsecurity.html#filters

specifies a clear ordering of filters. In particular, the documentation states
that the RememberMeProcessingFilter should come after the
AuthenticationProcessingFilter. In SecurityFilters.groovy, it looks like
RememberMeProcessingFilter would be called before AuthenticationProcessingFilter2.