anchor.diff:  </http>
   ----
   
  -or in Java configuration
  -
  -[source,java,attrs="-attributes"]
  -----
  -http
  -	.authorizeRequests(authorize -> authorize
  -		.antMatchers("/user/{userId}/**").access("@webSecurity.checkUserId(authentication,#userId)")
  -		...
  -	);
  -----
  -
  -In both configurations URLs that match would pass in the path variable (and convert it) into checkUserId method.
  +.Kotlin
  +[source,kotlin,role="secondary",attrs="-attributes"]
  +----
  +http {
  +    authorizeRequests {
  +        authorize("/user/{userId}/**", "@webSecurity.checkUserId(authentication,#userId)")
  +    }
  +}
  +----
  +====
  +
  +In this configuration URLs that match would pass in the path variable (and convert it) into checkUserId method.
   For example, if the URL were `/user/123/resource`, then the id passed in would be `123`.
   
   === Method Security Expressions
  
positive.code: </http>
  ----
  
  or in Java configuration
  
  
  [source,java]
  ----
  http
      .authorizeRequests(authorize -> authorize
          .antMatchers("/user/**").access("@webSecurity.check(authentication,request)")
          ...
      )
  ----
  
  [[el-access-web-path-variables]]
  ==== Path Variables in Web Security Expressions
  
negative.code: 
  You could refer to the method using:
  
  .Refer to method
  ====
  .Java
  [source,java,role="primary"]
  ----
  http
      .authorizeRequests(authorize -> authorize
          .antMatchers("/user/**").access("@webSecurity.check(authentication,request)")
          ...
      )
  ----
  
  .XML
  [source,xml,role="secondary"]
  ----
  <http>
  	<intercept-url pattern="/user/**"
  