Sort ObjectPostProcessors prior to invoking them

Fixes gh-3572

config/src/main/java/org/springframework/security/config/annotation/SecurityConfigurerAdapter.java

@@ -15,10 +15,12 @@
  */
 package org.springframework.security.config.annotation;
 
-import java.util.ArrayList;
-import java.util.List;
-
 import org.springframework.core.GenericTypeResolver;
+import org.springframework.core.annotation.AnnotationAwareOrderComparator;
+
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
 
 /**
  * A base class for {@link SecurityConfigurer} that allows subclasses to only implement
@@ -27,6 +29,7 @@ import org.springframework.core.GenericTypeResolver;
  * that is being configured.
  *
  * @author Rob Winch
+ * @author Wallace Wadge
  *
  * @param <O> The Object being built by B
  * @param <B> The Builder that is building O and is configured by
@@ -112,6 +115,7 @@ public abstract class SecurityConfigurerAdapter<O, B extends SecurityBuilder<O>>
 
 		@SuppressWarnings({ "rawtypes", "unchecked" })
 		public Object postProcess(Object object) {
+			Collections.sort(postProcessors, AnnotationAwareOrderComparator.INSTANCE);
 			for (ObjectPostProcessor opp : postProcessors) {
 				Class<?> oppClass = opp.getClass();
 				Class<?> oppType = GenericTypeResolver.resolveTypeArgument(oppClass,