anchor.diff:  You will need a client with read/write access to the `scim` resource to create user accounts.
   The integration tests take care of this automatically by inserting client and user accounts as necessary to make the tests work.
   
  -## <a id='samples'></a>Sample Applications ##
  +### <a id='samples'></a>Sample Applications ###
   
   Two sample applications are included with the UAA: `/api` and `/app`.
   
   Run them with `./gradlew run` from the `uaa` root directory. All three apps, `/uaa`, `/api`, and `/app` get deployed simultaneously.
   
  -### <a id='api-application'></a>The API Sample Application ###
  +#### <a id='api-application'></a>The API Sample Application ####
   
   An example resource server.
   It hosts a service that returns a list of mock applications under `/apps`.
   
  -### <a id='app-application'></a>The App Sample Application ###
  +#### <a id='app-application'></a>The App Sample Application ####
   
   This is a user interface app (primarily aimed at browsers) that uses OpenId Connect for authentication (i.e. SSO) and OAuth2 for access grants.
   It authenticates with the Auth service, then accesses resources in the API service.
  
positive.code: $ echo "spring_profiles: postgresql,default" > src/main/resources/uaa.yml
  $ ./gradlew run
  </pre>
  
  
  To bootstrap a microcloud-type environment, you need an admin client; there is a database initializer component that inserts one.
  If the default profile is active (i.e. not `postgresql`), there is also a `cf` CLI client so that the gem login works out of the box.
  
negative.code: $ ./gradlew run
  </pre>
  
  If successful, the three apps will run together on a single instance of Tomcat
  listening on port 8080, with endpoints `/uaa`, `/app`, and `/api`.
  
  ### <a id='cf'></a>Deploy to Cloud Foundry ###
  
  You can also build the app and push it to Cloud Foundry:
  
  <pre class="terminal">
  $ ./gradlew :cloudfoundry-identity-uaa:war
  $ cf push MYUAA -m 512M -p uaa/build/libs/cloudfoundry-identity-uaa-1.8.0.war --no-start
  $ cf set-env MYUAA SPRING_PROFILES_ACTIVE default
  $ cf start MYUAA
  </pre>
  
  In the steps above, replace the following:
  
  * `MYUAA` with a unique application name
  * `1.8.0` with the appropriate version label from your build
  
  ### <a id='demo-local'></a>Local Command Line Usage ###
  
  1. Run the UAA server as described above:
  
      <pre class="terminal">
      $ cd uaa
      $ ./gradlew run
      </pre>
  
  2. Start another terminal. From the project base directory, query the login endpoint about the system:
  
      <pre class="terminal">
      $ curl -H "Accept: application/json" localhost:8080/uaa/login
      {
        "timestamp":"2012-03-28T18:25:49+0100",
        "app" : {"version":"1.8.3"},
        "commit_id":"cba0958",
        "prompts":{"username":["text","Email"],
          "password":["password","Password"]
        }
      }
      </pre>
  
  3. Log in with the UAA Ruby gem:
  
      <pre class="terminal">
      $ gem install cf-uaac
      $ uaac target http://localhost:8080/uaa
      $ uaac token get marissa koala
      </pre>
  
      If you do not specify username and password, you will be prompted to supply
      them.
  
      This authenticates and obtains an access token from the server using the
      OAuth2 implicit grant, similar to the approach intended for a standalone
      client like the `cf` CLI.
      The token is stored in `~/.uaac.yml`.
      Open `~/.uaac.yml` to obtain the access token for your `cf` target, or use
      `--verbose` on the login command line above to see it in the command shell.
  
  4. Log in as a resource server and retrieve the token details:
  
      <pre class="terminal">
      $ uaac target http://localhost:8080/uaa
      $ uaac token decode [token-value-from-above]
      </pre>
  
      You should see your username and the client id of the original token grant
      on STDOUT:
  
      ~~~
        jti: e3a7d065-8514-43c2-b1f8-f8ab761791e2
        sub: f796d1a2-eca3-4079-a317-f3224f8f7832
        scope: scim.userids password.write openid cloud_controller.write cloud_controller.read
        client_id: cf
        cid: cf
        user_id: f796d1a2-eca3-4079-a317-f3224f8f7832
        user_name: marissa
        email: marissa@test.org
        iat: 1413495264
        exp: 1413538464
        iss: http://localhost:8080/uaa/oauth/token
        aud: scim openid cloud_controller password
      ~~~
  
  ### <a id='demo-hosted'></a>Remote Command Line Usage ###
  
  The command line example in the previous section should work against the UAA, although token encoding is unnecessary as you will not have the client secret.
  
  In this case, there is no need to run a local uaa server.
  Query the external login endpoint about the system:
  
  <pre class="terminal">
  $ curl -H "Accept: application/json" uaa.run.pivotal.io/login
  