anchor.diff:  <authentication-manager>
   <authentication-provider>
   	<user-service>
  -	<user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
  -	<user name="bob" password="bobspassword" authorities="ROLE_USER" />
  +	<!-- Password is prefixed with {noop} to indicate to DelegatingPasswordEncoder that
  +	NoOpPasswordEncoder should be used. This is not safe for production, but makes reading
  +	in samples easier. Normally passwords should be hashed using BCrypt -->
  +	<user name="jimi" password="{noop}jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
  +	<user name="bob" password="{noop}bobspassword" authorities="ROLE_USER" />
   	</user-service>
   </authentication-provider>
   </authentication-manager>
   ----
  +
  +This is an example of a secure way of storing the same passwords. The password is prefixed
  +with `{bcrypt}` to instruct `DelegatingPasswordEncoder`, which supports any configured
  +`PasswordEncoder` for matching, that the passwords are hashed using
  +BCrypt:
  +
  +[source,xml]
  +----
  +<authentication-manager>
  +<authentication-provider>
  +	<user-service>
  +	<user name="jimi" password="{bcrypt}$2a$10$ddEWZUl8aU0GdZPPpy7wbu82dvEw/pBpbRvDQRqA41y6mK1CoH00m"
  +			authorities="ROLE_USER, ROLE_ADMIN" />
  +	<user name="bob" password="{bcrypt}$2a$10$/elFpMBnAYYig6KRR5bvOOYeZr1ie1hSogJryg9qDlhza4oCw1Qka"
  +			authorities="ROLE_USER" />
  +	<user name="jimi" password="{noop}jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
  +	<user name="bob" password="{noop}bobspassword" authorities="ROLE_USER" />
  +	</user-service>
  +</authentication-provider>
  +</authentication-manager>
  +----
  +
  +
   
   [subs="quotes"]
   ****
  
positive.code: 
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  	auth
  		.jdbcAuthentication()
  			.dataSource(dataSource)
  			.withDefaultSchema()
  			.withUser("user").password("password").roles("USER").and()
  			.withUser("admin").password("password").roles("USER", "ADMIN");
  }
  ----
  
  
negative.code: <authentication-provider>
  	<password-encoder ref="bcryptEncoder"/>
  	<user-service>
  	<user name="jimi" password="$2a$10$ddEWZUl8aU0GdZPPpy7wbu82dvEw/pBpbRvDQRqA41y6mK1CoH00m"
  			authorities="ROLE_USER, ROLE_ADMIN" />
  	<user name="bob" password="$2a$10$/elFpMBnAYYig6KRR5bvOOYeZr1ie1hSogJryg9qDlhza4oCw1Qka"
  			authorities="ROLE_USER" />
  	</user-service>
  </authentication-provider>
  