anchor.diff:  and `j_password` to the `j_security_check` URL. This will be
   recognized by UberFireSecurityFilter as a login attempt.
   
  +=== Create a url_filter.yaml
  +
  +If we refused to serve _anything_ to an unauthenticated user, nobody
  +would be able to get to the beautiful login page we just created!
  +Fortunately there's a way to ``punch a hole'' in the security filter
  +so the login page and its linked assets (CSS, images) can be served.
  +
  +Create the file `src/main/resources/url_filter.yaml` and put this in
  +it:
  +
  +[source,yaml]
  +---------
  +filter:
  +   - pattern: /admin/**
  +     access: ADMIN
  +   - pattern: /config/**
  +     access: ADMIN, USER
  +   - pattern: /private/**
  +
  +exclude:
  +   - /*.ico
  +   - /UberFireTutorial/images/**
  +   - /UberFireTutorial/css/**
  +   - /css/**
  +   - /plugins/**
  +---------
  +
  +This example file shows you how to restrict certain URL paths to
  +certain roles, and also how to exclude some paths from the
  +authentication and authorization checks altogether.
  +
  +TODO: why doesn't login.html have to be in this list?
  +
   == Create a client-side entry point class
   
   Okay, enough mucking around with directory structure and configuration
  
positive.code: that only make sense in the client environment, such as Widgets and
  JavaScript Native Methods. We'll get to these topics later, but for
  now, just be sure to exclude your client-only classes from the .war
  file. We also omit the log4j.properties file from the .war file
  because it takes over JBoss Logging configuration.
  
  The `<packagingExcludes>` setting accepts a comma-separated list of
  patterns, so if you need to exclude more stuff later on, you can.
  
negative.code: one of those servers is running locally, you can deploy your app to it
  with the command `mvn jboss-as:deploy`.
  
  Phew! That's it for the `<plugins>` section.
  
  Just one more section to go, and you can skip it if nobody will even
  use Eclipse to develop your project.
  
  The `<pluginManagement>` section goes inside the `<build>` section
  (it's a sibling of <plugins>, not a child).
  