anchor.diff:  
   === Examine the JAX-RS resource
   
  -Open the `src/main/java/org/acme/opentracing/TracedResource.java` file and see the following content:
  +Open the `src/main/java/org/acme/jwt/TokenSecuredResource.java` file and see the following content:
   
   .Basic REST Endpoint
   [source,java]
  
positive.code: 2019-03-03 07:23:07,493 INFO  [io.quarkus] (main) Installed features: [cdi, resteasy, resteasy-jsonb, security, smallrye-jwt]
  ----
  
  Now that the REST endpoint is running, we can access using a command line tool like curl:
  
  .curl command for /secured/permit-all
  [source, bash]
  
negative.code:     }
  }
  ----
  <1> Here we inject the JsonWebToken interface, and extension of the java.security.Principal interface that provides access to the claims associated with the current authenticated token.
  <2> @PermitAll is a JSR 250 common security annotation that indicates that the given endpoint is accessible by any caller, authenticated or not.
  <3> Here we inject the JAX-RS SecurityContext to inspect the security state of the call.
  <4> Here we obtain the current request user/caller `Principal`. For an unsecured call this will be null, so we build the user name by checking `caller` against null.
  <5> The reply we build up makes use of the caller name, the `isSecure()` and `getAuthenticationScheme()` states of the request `SecurityContext`, and whether a non-null `JsonWebToken` was injected.
  
  == Run the application
  
  