anchor.diff:  
   `FrontendResource` will use REST Client with `OpenID Connect Client Reactive Filter` to acquire and propagate an access token to `ProtectedResource` when either `/frontend/user-name-with-oidc-client-token` or `/frontend/admin-name-with-oidc-client-token` is called. And it will use REST Client with `OpenID Connect Token Propagation Reactive Filter` to propagate the current incoming access token to `ProtectedResource` when either `/frontend/user-name-with-propagated-token` or `/frontend/admin-name-with-propagated-token` is called.
   
  -Finally, lets add a JAX-RS `ExceptionMapper`:
  +Finally, let's add a JAX-RS `ExceptionMapper`:
   
   [source,java]
   ----
  
positive.code: 
  [source,bash]
  ----
  curl -v -X GET \
    http://localhost:8080/frontend/admin-name-with-propagated-token` \
    -H "Authorization: Bearer "$access_token
  ----
  
  
negative.code: 
  [source,bash]
  ----
  curl -i -X GET \
    http://localhost:8080/frontend/admin-name-with-propagated-token \
    -H "Authorization: Bearer "$access_token
  ----
  
  will also return `200` status code and the name `admin`, as `admin` has both `user` and `admin` roles.
  
  
  Now let's check `FrontendResource` methods which do not propagate the existing tokens but use `OidcClient` to acquire and propagate the tokens. You have seen that `OidcClient` is configured to acquire the tokens for the `alice` user, so:
  
  [source,bash]
  ----
  curl -i -X GET \
    http://localhost:8080/frontend/user-name-with-oidc-client-token
  ----
  
  will return `200` status code and the name `alice`, but
  
  [source,bash]
  ----
  curl -i -X GET \
    http://localhost:8080/frontend/admin-name-with-oidc-client-token
  ----
  
  will return `403` status code.
  