anchor.diff:  
   [NOTE]
   ====
  -Since CORS requests are automatically dispatched, you *do not need* to change
  -`DispatcherServlet` `dispatchOptionsRequest` init parameter value, using its default value
  +Since CORS requests are automatically dispatched, you *do not need* to change the
  +`DispatcherServlet` `dispatchOptionsRequest` init parameter value; using its default value
   (`false`) is the recommended approach.
   ====
   
   == Controller method CORS configuration
   
  -You can add to your `@RequestMapping` annotated handler method a
  +You can add an
   http://docs.spring.io/spring/docs/4.2.x/javadoc-api/org/springframework/web/bind/annotation/CrossOrigin.html[`@CrossOrigin`]
  -annotation in order to enable CORS on it (by default `@CrossOrigin` allows all origins
  -and the HTTP methods specified in the `@RequestMapping` annotation):
  +annotation to your `@RequestMapping` annotated handler method in order to enable CORS on
  +it. By default `@CrossOrigin` allows all origins and the HTTP methods specified in the
  +`@RequestMapping` annotation:
   
   [source,java,indent=0]
   [subs="verbatim,quotes"]
  
positive.code: 
  For security reasons, browsers prohibit AJAX calls to resources residing outside the
  current origin. For example, as you're checking your bank account in one tab, you
  could have the evil.com website in another tab. The scripts from evil.com should not
  be able to make AJAX requests to your bank API  (withdrawing money from your account!)
  using your credentials.
  
  http://en.wikipedia.org/wiki/Cross-origin_resource_sharing[Cross-origin resource sharing]
  (CORS) is a http://www.w3.org/TR/cors/[W3C specification] implemented by
  http://caniuse.com/#feat=cors[most browsers] that allows you to specify in a flexible
  way what kind of cross domain requests are authorized, instead of using some less secured
  and less powerful hacks like IFrame or JSONP.
  
  As of Spring Framework 4.2, CORS is supported out of the box. CORS requests
  (https://github.com/spring-projects/spring-framework/blob/master/spring-webmvc/src/main/java/org/springframework/web/servlet/FrameworkServlet.java#L906[including preflight ones with an `OPTIONS` method])
  are automatically dispatched to the various `HandlerMapping` registered. They handle
  CORS preflight requests and intercept CORS simple and actual requests thanks to a
  http://docs.spring.io/spring/docs/4.2.x/javadoc-api/org/springframework/web/cors/CorsProcessor.html[CorsProcessor]
  implementation (https://github.com/spring-projects/spring-framework/blob/master/spring-web/src/main/java/org/springframework/web/cors/DefaultCorsProcessor.java[DefaultCorsProcessor]
  
negative.code: 
   * http://docs.spring.io/spring/docs/4.2.x/javadoc-api/org/springframework/web/servlet/handler/AbstractHandlerMapping.html#setCorsConfiguration-java.util.Map-[`AbstractHandlerMapping#setCorsConfiguration()`]
     allows to specify a `Map` with several http://docs.spring.io/spring/docs/4.2.x/javadoc-api/org/springframework/web/cors/CorsConfiguration.html[CorsConfiguration]
     instances mapped to path patterns like `/api/**`.
   * Subclasses can provide their own `CorsConfiguration` by overriding the
     `AbstractHandlerMapping#getCorsConfiguration(Object, HttpServletRequest)` method.
   * Handlers can implement the http://docs.spring.io/spring/docs/4.2.x/javadoc-api/org/springframework/web/cors/CorsConfigurationSource.html[`CorsConfigurationSource`]
     interface (like https://github.com/spring-projects/spring-framework/blob/master/spring-webmvc/src/main/java/org/springframework/web/servlet/resource/ResourceHttpRequestHandler.java[`ResourceHttpRequestHandler`]
     now does) in order to provide a http://docs.spring.io/spring/docs/4.2.x/javadoc-api/org/springframework/web/cors/CorsConfiguration.html[CorsConfiguration]
     instance for each request.