anchor.diff:  </bean>
   
   <security:user-service id="userService">
  -<security:user name="joe" password="joe" authorities="ROLE_USER" />
  +<!-- Password is prefixed with {noop} to indicate to DelegatingPasswordEncoder that
  +NoOpPasswordEncoder should be used. This is not safe for production, but makes reading
  +in samples easier. Normally passwords should be hashed using BCrypt -->
  +<security:user name="joe" password="{noop}joe" authorities="ROLE_USER" />
   ...
   </security:user-service>
   ----
  
positive.code: ----
  @Bean
  public UserDetailsService userDetailsService() throws Exception {
  	InMemoryUserDetailsManager manager = new InMemoryUserDetailsManager();
  	manager.createUser(User.withUsername("user").password("password").roles("USER").build());
  	manager.createUser(User.withUsername("admin").password("password").roles("USER","ADMIN").build());
  	return manager;
  }
  ----
  
negative.code: 
  @Autowired
  public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
  	// ensure the passwords are encoded properly
  	UserBuilder users = User.withDefaultPasswordEncoder();
  	auth
  		.jdbcAuthentication()
  			.dataSource(dataSource)
  			.withDefaultSchema()
  			.withUser(users.username("user").password("password").roles("USER"))
  			.withUser(users.username("admin").password("password").roles("USER","ADMIN"));
  }
  ----
  
  