anchor.diff:      }
   }
   ----
  -<1> Here we inject the JsonWebToken interface, and extension of the java.security.Prinicpal interface that provides access to the claims associated with the current authenticated token.
  +<1> Here we inject the JsonWebToken interface, and extension of the java.security.Principal interface that provides access to the claims associated with the current authenticated token.
   <2> @PermitAll is a JSR 250 common security annotation that indicates that the given endpoint is accessible by any caller, authenticated or not.
   <3> Here we inject the JAX-RS SecurityContext to inspect the security state of the call.
   <4> Here we obtain the current request user/caller `Principal`. For an unsecured call this will be null, so we build the user name by checking `caller` against null.
  -<5> The reply we build up makes use of the caller name, the `isSecure()` and `getAuthenticationScheme()` states of the request `SecurityContext`, and whether a non-null `JsonWebToken` has injected.
  +<5> The reply we build up makes use of the caller name, the `isSecure()` and `getAuthenticationScheme()` states of the request `SecurityContext`, and whether a non-null `JsonWebToken` was injected.
   
   == Run the application
   
  
positive.code: }
  ----
  
  This is a basic REST endpoint that does not have any of the {extension-name} specific features, so lets add some.
  
  NOTE: The {mp-jwt} 1.1.1 specification details the annotations and behaviors we will make use of in
  this quickstart. See https://github.com/eclipse/microprofile-jwt-auth/releases/download/1.1.1/microprofile-jwt-auth-spec.html[HTML]
  
negative.code: 2019-03-03 07:23:07,493 INFO  [io.quarkus] (main) Installed features: [cdi, resteasy, resteasy-jsonb, security, smallrye-jwt]
  ----
  
  Now that the REST endpoint is running, we can access it using a command line tool like curl:
  
  .curl command for /secured/permit-all
  [source, bash]
  