anchor.diff:          ...
           IsisModuleSecuritySpring.class,
           AuthorizorBypass.class,
  -        SecurityConfig.class,           // <.>
  +        SecurityConfig.class,
           ...
   })
   public class AppManifest {
   }
   ----
  -<.> as above
   
   
   === Code Patch
   
  -In the current release of Apache Isis ({page-rel}), there is an issue with its `SpringSecurityFilter`; it does not recognise `UserDetails` as a valid authenticated principal.
  +In the current release of Apache Isis ({page-isisrel}), there is an issue with its `SpringSecurityFilter`; it does not recognise `UserDetails` as a valid authenticated principal.
   We therefore (for now) need to patch in our own replacement.
   
   [source,java]
  
positive.code: 
  === Run the application
  
  You should now be able to run the application, selecting the "github-example" profile using this JVM argument:
  
      -Dspring.profiles.active=github-example
  
  If you are already signed into github:
  
  image::github-already-signed-in.png[width=200px]
  
  then you should be logged in directly; the app will show your user name:
  
  image::helloworld-shows-username.png[width=250px]
  
  On the other hand, if you are not signed in then you will be redirected to the github login page:
  
  image::github-login-page.png[width=300px]
  
  If you have 2FA enabled, then this also works:
  
  image::github-2fa.png[width=300px]
  
  and then, once again, you will be redirected to the app and it will show your user name:
  
  image::helloworld-shows-username.png[width=250px]
  
  Finally, if you log out then Spring will show a page to allow you to trigger the login process:
  
  image::github-sign-in-again.png[width=500px]
  
negative.code: 
  
  
  == Walk-through : In-memory
  
  Using Spring Security we can configure your app with various authentication providers.
  In this section we describe how to modify the xref:docs:starters:helloworld.adoc[HelloWorld] starter app to use an in-memory authenticator.
  
  TIP: These changes have been applied to the `origin/jdo-spring-security-inmemory` branch.
  
  === Code Changes
  
  