anchor.diff:  [source,java]
   ----
   mvc
  -	.perform(formLogin().user("admin").roles("USER","ADMIN"))
  -	.andExpect(authenticated().withUsername("admin"));
  +	.perform(formLogin().user("admin"))
  +	.andExpect(authenticated().withUsername("admin").withRoles("USER", "ADMIN"));
   ----
   
   We can also make arbitrary assertions on the authentication
  
positive.code: assertThat(jwt.getTokenValue()).isEqualTo("token");
  assertThat(jwt.getHeaders().get("alg")).isEqualTo("none");
  assertThat(jwt.getSubject()).isEqualTo("sub");
  GrantedAuthority authority = jwt.getAuthorities().iterator().next();
  assertThat(authority.getAuthority()).isEqualTo("read");
  ----
  
  These values can, of course be configured.
  
negative.code: Jwt jwt = Jwt.withTokenValue("token")
      .header("alg", "none")
      .claim("sub", "user")
      .claim("scope", "read")
      .build();
  
  mvc
      .perform(get("/endpoint")
  