From 59b1373460aefd9cd767efddbaa87454ca9952f5 Mon Sep 17 00:00:00 2001
From: Justin Richer <jricher@mit.edu>
Date: Tue, 21 Jan 2014 21:02:53 -0500
Subject: [PATCH] oops. missed a couple things. this should actually do it for
 us now. addresses #490

---
 .../src/main/webapp/WEB-INF/application-context.xml            | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/openid-connect-server-webapp/src/main/webapp/WEB-INF/application-context.xml b/openid-connect-server-webapp/src/main/webapp/WEB-INF/application-context.xml
index e68622716..ff1eab1ea 100644
--- a/openid-connect-server-webapp/src/main/webapp/WEB-INF/application-context.xml
+++ b/openid-connect-server-webapp/src/main/webapp/WEB-INF/application-context.xml
@@ -67,11 +67,10 @@
 		create-session="stateless"
 		authentication-manager-ref="clientAuthenticationManager"
 		entry-point-ref="oauthAuthenticationEntryPoint"
-		user-expressions="true">
+		use-expressions="true">
 		
 		<security:intercept-url pattern="/token" access="permitAll" method="OPTIONS" /> <!-- allow OPTIONS calls without auth for CORS stuff -->
 		<security:intercept-url pattern="/token" access="isAuthenticated()" />
-		<security:anonymous enabled="false" />
 		<security:http-basic entry-point-ref="oauthAuthenticationEntryPoint" />
 		<!-- include this only if you need to authenticate clients via request parameters -->
 		<security:custom-filter ref="clientAssertiontokenEndpointFilter" after="PRE_AUTH_FILTER" /> <!-- this one has to go first -->