anchor.diff:      }
   
       private Map<String, Object> verifyToken(String token) throws NoSuchAlgorithmException, InvalidKeyException, IOException, SignatureException, JWTVerifyException {
  -        JWTVerifier verifier = new JWTVerifier(secret, audience);
  +        JWTVerifier verifier = new JWTVerifier(secret, audience); <1>
           return verifier.verify(token);
       }
   
  -    private List<String> findPermissions(Map<String, Object> tokenInfo) {
  +    private List<String> findPermissions(Map<String, Object> tokenInfo) {<2>
           List<String> permissions = new ArrayList<>();
           Map<String, Object> appMetadata = (Map<String, Object>) tokenInfo.get("app_metadata");
           if (appMetadata == null) {
  
positive.code: <1> add the handler
  <2> add authority: only users with the permission "create:user" will be able to use the API
  
  https://gist.githubusercontent.com/cdelmas/dcb45c703a25249147fe/raw/78155e103a0dcaa0714ac1d5e6109482489edba5/Main.java[source]
  
  
  The `JWTAuthHandler` will parse the Authorization header, extract the token, and pass it to a `AuthProvider`. So next, you have to provide that `AuthProvider`, to parse the token and extract authorizations:
  
  [source,java]
  -------
  public class Auth0TokenVerifier implements AuthProvider {
  
  
negative.code:     }
  }
  -------
  <1> Token verification: the token is decoded and the signature is verified. You can debug a JWT http://jwt.io[here].
  <2> Permissions are extracted from the token. Auth0 provides a app_metadata object to store arbitrary data such as roles.
  
  Last, you just write a `User` class extending `AbstractUser` to handle the authorities:
  
  