anchor.diff:  
   With WebSockets the Same Origin Policy does not apply.
   In fact, unless bank.com explicitly forbids it, evil.com can read and write data on behalf of the user.
  -This means that anything the user can do over the websocket (i.e. transfer money), evil.com can do on that users behalf.
  +This means that anything the user can do over the webSocket (i.e. transfer money), evil.com can do on that users behalf.
   
   Since SockJS tries to emulate WebSockets it also bypasses the Same Origin Policy.
   This means developers need to explicitly protect their applications from external domains when using SockJS.
  
positive.code:         </b:bean>
      </b:constructor-arg>
  </b:bean>
  ----
negative.code: 
  This will ensure that:
  
  <1> Any message without a destination (i.e. anything other than Message type of MESSAGE or SUBSCRIBE) will require the user to be authenticated
  <2> Anyone can subscribe to /user/queue/errors
  <3> Any message that has a destination starting with "/app/" will be require the user to have the role ROLE_USER
  <4> Any message that starts with "/user/" or "/topic/friends/" that is of type SUBSCRIBE will require ROLE_USER
  