anchor.diff:  )
   ----
   <1> There are different credential types that can be used to authenticate with the issue tracker, e.g. application tokens, OAuth authentication, user/password, etc.
  -The only common feature is that we need each credential to have a StandardCredentials.getId()` to allow retrieval when building the job.
  +The only common feature is that we need each credential to have a IdCredentials.getId()` to allow retrieval when building the job.
   <2> We need to limit the credentials to those types that we can actually use to authenticate with the issue tracker.
   We leverage the https://wiki.jenkins.io/display/JENKINS/Authentication+Tokens+API+Plugin[Authentication Tokens API] to convert the Jenkins credentials types into the issue tracker API's native authentication types.
   This means that we can use the `AuthenticationTokens.matcher(Class)` to restrict the list of credentials to the subset that can be converted.
  +Alternatively, more complex conversion contexts can be handled with `AuthenticationTokens.matcher(AuthenticationTokenContext)`
   
   * We want to let the user select the credentials to toggle the deployment state of a blue/green deployment for a completed build.
   +
  
positive.code: );
  ----
  <1> We want username password credentials and we want the user to be able to selected them
  We need `StandardCredentials.getId()` to allow retrieval when building the job.
  We need `UsernamePasswordCredentials` to ensure that they are username and password.
  <2> We will be using these credentials in the context of a specific job.
  <3> For almost all implementations of `Job`, this will be `true`.
  
negative.code:   </f:entry>
  </j:jelly>
  ----
  +
  [NOTE]
  ====
  The `expressionAllowed` option only makes sense for configuring credentials that will be used in the context of a `hudson.model.Run` (technically it must be a `Run` of a `ParameterizedJob`).
  ====
  
  * In the case where the credentials will be used immediately in the context of the user selecting the credentials (as opposed to deferred usage in the context of a queued build job), you may want to allow credentials from the user's per-user credentials store:
  +
  