anchor.diff:  [source,java]
   ----
   http
  -    .authorizeUrls()
  -        .antMatchers("/user/{userId}/**").access("@webSecurity.checkUserId(authentication,userId)")
  -        ...
  +		.authorizeUrls()
  +				.antMatchers("/user/{userId}/**").access("@webSecurity.checkUserId(authentication,userId)")
  +				...
   ----
   
   In both configurations URLs that match would pass in the path variable (and convert it) into checkUserId method.
  
positive.code: public class WebSecurityConfig extends
  WebSecurityConfigurerAdapter {
  
  @Override
  protected void configure(HttpSecurity http) throws Exception {
  	http
  	// ...
  	.headers()
  		.frameOptions()
  			.sameOrigin()
  			.and()
  		.hsts().disable();
  }
  }
  ----
  
  
negative.code: ----
  @Bean
  public BCryptPasswordEncoder passwordEncoder() {
  		return new BCryptPasswordEncoder();
  }
  ----
  
  