anchor.diff:  - `Authorization` header, as `Authorization: Bearer <token>`
   - `access_token` query parameter, as `http://example.org/the/path/?access_token=<token>`
   
  -First, let's retrieve a fresh token, and extract the `access_token` field
  -
  -```
  -curl -X POST http://127.0.0.1:8080/auth/realms/stottie/protocol/openid-connect/token  -H "Content-Type: application/x-www-form-urlencoded" -d "username=rincewind" -d 'password=apiman' -d 'grant_type=password' -d 'client_id=apiman' | jsawk 'return this.access_token'
  +First, let's retrieve a fresh token from Keycloak, and extract the `access_token` field from the json using `jq` footnote:[We're going to use `jq` to select the `access_token` field in our JSON, so if you don't have `jq` installed you can use your package manager to get it: OS X Brew `brew install jq`; On Fedora `sudo yum install jq`; On Debian `sudo apt-get install jq`].
  +
  +```
  +curl -X POST http://127.0.0.1:8080/auth/realms/stottie/protocol/openid-connect/token  -H "Content-Type: application/x-www-form-urlencoded" -d 'username=rincewind' -d 'password=apiman' -d 'grant_type=password' -d 'client_id=apiman' | jq -r '.access_token'
   ```
   
   Second, we'll take the token and attach it to our request to the service
  
positive.code:  https://127.0.0.1:8443/apiman-gateway/Newcastle/EchoService/2.0/rincewind/wizard
  {
    "method" : "GET",
    "resource" : "/services/echo/rincewind/wizard",
    "uri" : "/services/echo/rincewind/wizard",
    "headers" : {
      "Authorization" : "Bearer eyJhbGciOiJSUzI1NiJ9.eyJqdGkiOiJmODAyZjFmMy1kN2JmLTQ0YjQtODA2N...",
      "Host" : "127.0.0.1:8080",
  
negative.code: 
  First, log into apiman, and *Create a New Organization*; let's call it *_Newcastle_*. Select the *Services* tab, and add a *New Service*; we'll name this one *_EchoService_* and then *Create Service*.
  
  Select the *Implementation* tab, and set the endpoint to our echo service, `http://localhost:8080/apiman-echo`. Save and move onto the *Plans* tab, where you should opt to *Make this service public*. After saving, we can move onto the *Policies* tab, where the interesting stuff starts.
  
  Navigate to *Add Policy*, and select *Keycloak OAuth Policy* from the drop-down list. A substantial set of options are available for your perusal, but for the purposes of this blog demo we'll set the following:
  
  