anchor.diff:  }
   ----
   
  +
  +=== Tidying up
  +
   Finally, (and optionally), the swagger/REST API is not configured for oauth2, so we replace the `index.html` page with one to redirect straight to the xref:vw::about.adoc[Wicket Viewer]:
   
  +[source,html]
  +.static/index.html
  +----
  +<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
  +<html xmlns:th="http://www.thymeleaf.org">
  +<head>
  +    <meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1">
  +    <meta http-equiv="refresh" content="0;url=/wicket/" />
  +</head>
  +<body>
  +<div id="wrapper">
  +    <!-- we just redirect immediately, because swagger/restful API not configured to use spring security -->
  +</div>
  +</body>
  +</html>
  +----
   
   === Configuration
   
  
positive.code: }
  ----
  
  Finally, (and optionally), the swagger/REST API is not configured for oauth2, so we replace the `index.html` page with one to redirect straight to the xref:vw::about.adoc[Wicket Viewer]:
  
  [source,html]
  .static/index.html
  
negative.code: @Configuration
  @Import({
          ...
          IsisModuleSecuritySpring.class,     // <.>
          AuthorizorBypass.class,             // <.>
          ...
  })
  public class AppManifest {
  }
  ----
  <.> make sure that no other `IsisModuleSecurityXxx` module is imported.
  <.> or some other implementation of `Authorizor`.
  
  
  == Design
  