anchor.diff:      }
   }
   ----
  -
  -Finally, let's consider the `/api/users/me` endpoint. As you can see from the source code below, we are trusting only users with the `user` role.
  -We are using `SecurityContext` to get access to the current authenticated Principal, and we return the user's name. This information is loaded from the database.
  -
  +* Finally, implement the `/api/users/me` endpoint. As you can see from the source code example below, we are trusting only users with the `user` role.
  +We are also using `SecurityContext` to get access to the currently authenticated `Principal`, and we return the user name, all of which is loaded from the database.
   [source,java]
   ----
   package org.acme.security.jpa;
  
positive.code: 
  === Password storage and hashing
  
  By default, we consider passwords to be stored hashed with https://en.wikipedia.org/wiki/Bcrypt[bcrypt] under the 
  https://en.wikipedia.org/wiki/Crypt_(C)[Modular Crypt Format] (MCF).
  
  When you need to create such a hashed password we provide the convenient `String BcryptUtil.bcryptHash(String password)`
  function, which defaults to creating a random salt and hashing in 10 iterations (though you can specify the iterations and salt
  too).
  
  NOTE: with MCF you don't need dedicated columns to store the hashing algorithm, the iterations count or the salt because
  they're all stored in the hashed value.
  
  You also have the possibility to store password using different hashing algorithm `@Password(value = PasswordType.CUSTOM, provider = CustomPasswordProvider.class)`:
  
  [source,java]
  ----
  
negative.code: 
  ----
  
  The `security-jpa` extension initializes only if there is a single entity annotated with `@UserDefinition`.
  
  <1> The `@UserDefinition` annotation must be present on a single entity and can be either a regular Hibernate ORM entity or a Hibernate ORM with Panache entity.
  <2> Indicates the field used for the user name.
  <3> Indicates the field used for the password, which defaults to using bcrypt hashed passwords but you can also configure it for plain text or custom passwords.
  <4> This indicates the comma-separated list of roles added to the target principal representation attributes.
  <5> This method allows us to add users while hashing the password with the proper bcrypt hash.
  
  === Configure the application
  
  . Enable xref:security-built-in-authentication.adoc#basic-auth[Quarkus built-in basic HTTP authentication] by setting the `quarkus.http.auth.basic` property to `true`:
  +
  `quarkus.http.auth.basic`=true`
  +
  [NOTE]
  ====
  When secure access is required and no other authentication mechanisms are enabled, xref:security-built-in-authentication.adoc#basic-auth[Quarkus built-in basic HTTP authentication] is the fallback authentication mechanism. 
  Therefore, in this tutorial, you do not need to set the property `quarkus.http.auth.basic=true`.
  ====
  +
  . Configure at least one data source so that the `security-jpa` extension can access your database.
  +
  [source,properties]
  ----
  quarkus.http.auth.basic=true
  