anchor.diff:  ----
   
   and it will (in addition to loggin the user in and grabbing a token)
  -pass the authentication token downstream to the `/proxy/*` services.
  +pass the authentication token downstream to the `/proxy/*`
  +services. If those services are implemented with
  +`@EnableOAuth2Resource` then they will get a valid token in the
  +correct header.
  +
  +How does it work? The `@EnableOAuth2Sso` annotation pulls in
  +`spring-cloud-starter-security` (which you could do manually in a
  +traditional app), and that has some autoconfiguration for a
  +`ZuulFilter`, which itself is activated because Zuul is on the
  +classpath (via `@EnableZuulProxy`). The
  +{security-base}/tree/master/src/main/java/org/springframework/cloud/security/proxy/OAuth2TokenRelayFilter.java[filter]
  +just extracts an access token from the currently authenticated user,
  +and puts it in a request header for the downstream requests.
  
positive.code: = Spring Cloud Cluster
  
  include::intro.adoc[]
  
  
negative.code: .app.groovy
  [source,java]
  ----
  @Controller
  @EnableOAuth2Sso
  @EnableZuulProxy
  