anchor.diff:  </bean>
   
   <security:user-service id="userService">
  -<security:user name="joe" password="joe" authorities="ROLE_USER" />
  +<!-- Password is prefixed with {noop} to indicate to DelegatingPasswordEncoder that
  +NoOpPasswordEncoder should be used. This is not safe for production, but makes reading
  +in samples easier. Normally passwords should be hashed using BCrypt -->
  +<security:user name="joe" password="{noop}joe" authorities="ROLE_USER" />
   ...
   </security:user-service>
   ----
  
positive.code: <authentication-manager>
  <authentication-provider>
  	<user-service>
  	<user name="jimi" password="jimispassword" authorities="ROLE_USER, ROLE_ADMIN" />
  	<user name="bob" password="bobspassword" authorities="ROLE_USER" />
  	</user-service>
  </authentication-provider>
  </authentication-manager>
  ----
  
  [subs="quotes"]
  ****
  
negative.code: 
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  	// ensure the passwords are encoded properly
  	UserBuilder users = User.withDefaultPasswordEncoder();
  	auth
  		.jdbcAuthentication()
  			.dataSource(dataSource)
  			.withDefaultSchema()
  			.withUser(users.username("user").password("password").roles("USER"))
  			.withUser(users.username("admin").password("password").roles("USER","ADMIN"));
  }
  ----
  
  