anchor.diff:  Not authorized
   ----
   
  -Excellent, we have not provided any JWT in the request, so we should not be able to access the endpoint, and we were not. Instead we received an HTTP 401 Unauthorized error. We need to obtain and pass in a valid JWT to access that endpoint. There are two steps to this, 1) configuration our {extension-name} extension with information on how to validate a JWT, and 2) generating a matching JWT with the appropriate claims.
  +Excellent, we have not provided any JWT in the request, so we should not be able to access the endpoint, and we were not. Instead we received an HTTP 401 Unauthorized error. We need to obtain and pass in a valid JWT to access that endpoint. There are two steps to this, 1) configuring our {extension-name} extension with information on how to validate a JWT, and 2) generating a matching JWT with the appropriate claims.
   
   == Configuring the {extension-name} Extension Security Information
   
  
positive.code: }
  ----
  
  This is a basic REST endpoint that does not have any of the {extension-name} specific features, so lets add some.
  
  NOTE: The {mp-jwt} 1.1.1 specification details the annotations and behaviors we will make use of in
  this quickstart. See https://github.com/eclipse/microprofile-jwt-auth/releases/download/1.1.1/microprofile-jwt-auth-spec.html[HTML]
  
negative.code:     }
  }
  ----
  <1> Here we inject the JsonWebToken interface, and extension of the java.security.Principal interface that provides access to the claims associated with the current authenticated token.
  <2> @PermitAll is a JSR 250 common security annotation that indicates that the given endpoint is accessible by any caller, authenticated or not.
  <3> Here we inject the JAX-RS SecurityContext to inspect the security state of the call.
  <4> Here we obtain the current request user/caller `Principal`. For an unsecured call this will be null, so we build the user name by checking `caller` against null.
  <5> The reply we build up makes use of the caller name, the `isSecure()` and `getAuthenticationScheme()` states of the request `SecurityContext`, and whether a non-null `JsonWebToken` was injected.
  
  == Run the application
  
  