anchor.diff:      }
   }
   ----
  +
  +.Xml
  +[source,xml,role="secondary"]
  +----
  +<http>
  +    <intercept-uri pattern="/contacts/**" access="hasAuthority('SCOPE_contacts')"/>
  +    <intercept-uri pattern="/messages/**" access="hasAuthority('SCOPE_messages')"/>
  +    <oauth2-resource-server>
  +        <jwt jwk-set-uri="https://idp.example.org/.well-known/jwks.json"/>
  +    </oauth2-resource-server>
  +</http>
  +----
   ====
   
   Or similarly with method security:
  
positive.code:     );
  ----
  
  This is nice because the issuer endpoints are loaded lazily.
  In fact, the corresponding `JwtAuthenticationProvider` is instantiated only when the first request with the corresponding issuer is sent.
  This allows for an application startup that is independent from those authorization servers being up and available.
  
negative.code: 
  For example, the second `@Bean` Spring Boot creates is a `JwtDecoder`, which decodes `String` tokens into validated instances of `Jwt`:
  
  
  .JWT Decoder
  ====
  [source,java]
  ----
  @Bean
  