anchor.diff:  certain roles, and also how to exclude some paths from the
   authentication and authorization checks altogether.
   
  -TODO: why doesn't login.html have to be in this list?
  +TODO: why doesn't login.jsp have to be in this list?
   
   At this point, we have fully configured UberFire Security.
   
  
positive.code: 
  == Set up UberFire security
  
  === Define users and roles
  
  Our application uses the `PropertyUserSource` for its list of users,
  
negative.code: and `j_password` to the `j_security_check` URL. This will be
  recognized by UberFireSecurityFilter as a login attempt.
  
  TODO: `/login.jsp` should not be a hardcoded path. Could rely mostly on
  the welcome-page setting in web.xml.
  
  === Create a url_filter.yaml
  
  If we refused to serve _anything_ to an unauthenticated user, nobody
  