anchor.diff:  	}
   }
   ----
  -====
  -
  -The same can be achieved with XML based configuration:
  -
  -.DelegatingRequestMatcherHeaderWriter XML Configuration
  -====
  -[source,xml]
  +
  +.XML
  +[source,xml,role="secondary"]
   ----
   <http>
   	<!-- ... -->
  
positive.code: 	</headers>
  </http>
  ----
  ====
  
  If you do not want the defaults to be added and want explicit control over what should be used, you can disable the defaults.
  An example for both Java and XML based configuration is provided below:
  
  If you are using Spring Security's Java Configuration the following will only add <<headers-cache-control,Cache Control>>.
  
  [source,java]
  ----
  @EnableWebSecurity
  public class WebSecurityConfig extends
  
negative.code: ----
  ====
  
  You can enable the CSP header as shown below:
  
  .Content Security Policy
  ====
  .Java
  [source,java,role="primary"]
  ----
  @EnableWebSecurity
  public class WebSecurityConfig extends
  