anchor.diff:          ...
           IsisModuleSecuritySpring.class,
           AuthorizorBypass.class,
  -        SecurityConfig.class,           // <.>
  +        SecurityConfig.class,
           ...
   })
   public class AppManifest {
   }
   ----
  -<.> as above
   
   
   === Code Patch
   
  -In the current release of Apache Isis ({page-rel}), there is an issue with its `SpringSecurityFilter`; it does not recognise `UserDetails` as a valid authenticated principal.
  +In the current release of Apache Isis ({page-isisrel}), there is an issue with its `SpringSecurityFilter`; it does not recognise `UserDetails` as a valid authenticated principal.
   We therefore (for now) need to patch in our own replacement.
   
   [source,java]
  
positive.code: }
  ----
  
  Finally, (and optionally), the swagger/REST API is not configured for oauth2, so we replace the `index.html` page with one to redirect straight to the xref:vw::about.adoc[Wicket Viewer]:
  
  [source,html]
  .static/index.html
  
negative.code: In this section we describe how to modify the xref:docs:starters:helloworld.adoc[HelloWorld] starter app to use github as an OAuth2 provider.
  The steps here are based on link:https://spring.io/guides/tutorials/spring-boot-oauth2/[this Spring tutorial].
  
  TIP: These changes have been applied to the `origin/jdo-spring-security-oauth2` branch.
  
  === Code Changes
  
  First, we add in the OAuth2 client dependency:
  
  [source,xml]
  .pom.xml
  ----
  