anchor.diff:  ----
   OidcUser oidcUser = new DefaultOidcUser(
           AuthorityUtils.createAuthorityList("SCOPE_message:read"),
  -        Collections.singletonMap("user_name", "foo_user"),
  +        OidcIdToken.withTokenValue("id-token").claim("user_name", "foo_user").build(),
           "user_name");
   
   mvc
  
positive.code: [source,java]
  ----
  mvc
  	.perform(formLogin().user("admin").roles("USER","ADMIN"))
  	.andExpect(authenticated().withUsername("admin"));
  ----
  
  We can also make arbitrary assertions on the authentication
  
negative.code: assertThat(jwt.getTokenValue()).isEqualTo("token");
  assertThat(jwt.getHeaders().get("alg")).isEqualTo("none");
  assertThat(jwt.getSubject()).isEqualTo("sub");
  ----
  
  These values can, of course be configured.
  