anchor.diff:  ==== Resolving the CsrfToken
   
   Spring Security provides `CsrfTokenResolver` which can automatically resolve the current `CsrfToken` for Spring MVC arguments.
  -By using <<mvc-enablewebsecurity>> you will automatically have this added to your Spring MVC configuration.
  +By using <<jc-hello-wsca,@EnableWebSecurity>> you will automatically have this added to your Spring MVC configuration.
   If you use XML based configuraiton, you must add this yourself.
   
   Once `CsrfTokenResolver` is properly configured, you can expose the `CsrfToken` to your static HTML based application.
  
positive.code: [[nsa-websocket-message-broker]]
  ==== <websocket-message-broker>
  
  The websocket-message-broker element has two different modes. If the <<nsa-websocket-id>> is not specified, then it will do the following things:
  
  * Ensure that any SimpAnnotationMethodMessageHandler has the AuthenticationPrincipalArgumentResolver registered as a custom argument resolver. This allows the use of `@AuthenticationPrincipal` to resolve the principal of the current `Authentication`
  * Ensures that the SecurityContextChannelInterceptor is automatically registered for the clientInboundChannel. This populates the SecurityContextHolder with the user that is found in the Message
  
negative.code: More technically speaking, Spring Security integrates with `WebAsyncManager`. The `SecurityContext` that is used to process the `Callable` is the `SecurityContext` that exists on the `SecurityContextHolder` at the time `startCallableProcessing` is invoked.
  ====
  
  There is no automatic integration with a `DeferredResult` that is returned by controllers.
  This is because `DeferredResult` is processed by the users and thus there is no way of automatically integrating with it.
  However, you can still use <<concurrency,Concurrency Support>> to provide transparent integration with Spring Security.
  
  [[mvc-csrf]]
  === Spring MVC and CSRF Integration
  