anchor.diff:  
   Next, we can construct a `JWTProcessor`:
   
  -[source,java]
  +====
  +.Java
  +[source,java,role="primary"]
   ----
   @Bean
   JWTProcessor jwtProcessor(JWTClaimSetJWSKeySelector keySelector) {
  
positive.code: 
  Or similarly with method security:
  
  ```java
  @PreAuthorize("hasAuthority('SCOPE_messages')")
  public List<Message> getMessages(...) {}
  ```
  
  [[oauth2resourceserver-opaque-authorization-extraction]]
  ==== Extracting Authorities Manually
  
negative.code: }
  ----
  
  .Kotlin
  [source,kotlin,role="secondary"]
  ----
  @GetMapping("/foo")
  fun foo(authentication: BearerTokenAuthentication): String {
      return authentication.tokenAttributes["sub"].toString() + " is the subject"
  }
  ----
  ====
  
  Since `BearerTokenAuthentication` holds an `OAuth2AuthenticatedPrincipal`, that also means that it's available to controller methods, too:
  
  ====
  .Java
  [source,java,role="primary"]
  ----
  @GetMapping("/foo")
  public String foo(@AuthenticationPrincipal OAuth2AuthenticatedPrincipal principal) {
  