anchor.diff:  `OAuth2SsoConfigurer` beans as well. The default logout path is
   "/logout" and it gets similar treatment, as does the "home" page
   (which is the logout success page, defaults to "/"). Those paths can
  -be overriden by setting `oauth2.sso.\*' (`loginPath`, `logoutPath` and
  +be overriden by setting `oauth2.sso.*' (`loginPath`, `logoutPath` and
   `home.path`).
   
   For example if you want the resources under "/ui/**" to be protected with OAuth2:
  
positive.code: 
  * `oauth2.client.\*` with `*` equal to `clientId`, `clientSecret`,
    `tokenUri`, `authorizationUri` and one of:
  
  * `oauth2.resource.preferTokenInfo=false` and
    `oauth2.resource.userInfoUri` to use the "/me" resource
    (e.g. "https://uaa.run.pivotal.io/userinfo" on PWS), or
  
  * `oauth2.resource.tokenInfoUri` to use the token decoding endpoint
    (e.g. "https://uaa.run.pivotal.io/check_token" on PWS), or
  
  * `oauth2.resource.jwt.keyValue` or `oauth2.resource.jwt.keyUri` to
    decode a JWT token locally, where the key is a verification key. The
    verification key value is either a symmetric secret or PEM-encoded
    RSA public key. If you don't have the key and it's public you can
    provide a URI where it can be downloaded (as a JSON object with a
    "value" field). E.g. on PWS:
    + 
  ----
  $ curl https://uaa.run.pivotal.io/token_key
  
negative.code: {security-base}/tree/master/src/main/java/org/springframework/cloud/security/oauth2/proxy/OAuth2TokenRelayFilter.java[filter]
  just extracts an access token from the currently authenticated user,
  and puts it in a request header for the downstream requests.
  
  ## Configuring Downstream Authentication
  
  You can control the authorization behaviour downstream of an
  `@EnableZuulProxy` through the `proxy.auth.*` settings. Example:
  