Accounted for feedback

Incorporated suggested changes from a review.

docs/manual/src/docs/asciidoc/_includes/about/authentication/password-storage.adoc

@@ -9,7 +9,7 @@ Typically, `PasswordEncoder` is used for storing a password that needs to be com
 == Password Storage History
 
 Throughout the years, the standard mechanism for storing passwords has evolved.
-In the beginning, passwords were stored in plain text.
+In the beginning, passwords were stored in plaintext.
 The passwords were assumed to be safe because the data store the passwords were saved in required credentials to access it.
 However, malicious users were able to find ways to get large "`data dumps`" of usernames and passwords by using attacks such as SQL Injection.
 As more and more user credentials became public, security experts realized that we needed to do more to protect users' passwords.
@@ -189,8 +189,8 @@ By default, the result of invoking `matches(CharSequence, String)` with a passwo
 This behavior can be customized by using `DelegatingPasswordEncoder.setDefaultPasswordEncoderForMatches(PasswordEncoder)`.
 
 By using the `id`, we can match on any password encoding but encode passwords by using the most modern password encoding.
-This is important, because unlike encryption, password hashes are designed so that there is no simple way to recover the plain text.
-Since there is no way to recover the plain text, it is difficult to migrate the passwords.
+This is important, because unlike encryption, password hashes are designed so that there is no simple way to recover the plaintext.
+Since there is no way to recover the plaintext, it is difficult to migrate the passwords.
 While it is simple for users to migrate `NoOpPasswordEncoder`, we chose to include it by default to make it simple for the getting-started experience.
 
 [[authentication-password-storage-dep-getting-started]]

docs/manual/src/docs/asciidoc/_includes/about/exploits/headers.adoc

@@ -246,7 +246,7 @@ Content-Security-Policy-Report-Only: script-src 'self' https://trustedscripts.ex
 ----
 ====
 
-If the site violates this policy, by attempting to load a script from evil.com, the user-agent sends a violation report to the declared URL specified by the `report-uri` directive but still lets the violating resource load.
+If the site violates this policy, by attempting to load a script from `evil.example.com`, the user-agent sends a violation report to the declared URL specified by the `report-uri` directive but still lets the violating resource load.
 
 Applying Content Security Policy to a web application is often a non-trivial undertaking.
 The following resources may provide further assistance in developing effective security policies for your site:

docs/manual/src/docs/asciidoc/_includes/servlet/authentication/unpwd/form.adoc

@@ -6,9 +6,9 @@ This section provides details on how form based authentication works within Spri
 // FIXME: describe authenticationentrypoint, authenticationfailurehandler, authenticationsuccesshandler
 
 This section examines how form-based login works within Spring Security.
-First, we see how the user is redirected to the log in form:
+First, we see how the user is redirected to the login form:
 
-.Redirecting to the Log In Page
+.Redirecting to the Login Page
 image::{figures}/loginurlauthenticationentrypoint.png[]
 
 The preceding figure builds off our <<servlet-securityfilterchain,`SecurityFilterChain`>> diagram.
@@ -22,7 +22,7 @@ In most cases, the `AuthenticationEntryPoint` is an instance of {security-api-ur
 
 image:{icondir}/number_4.png[] The browser requests the login page to which it was redirected.
 
-image:{icondir}/number_5.png[] Something within the application must <<servlet-authentication-form-custom,render the log in page>>.
+image:{icondir}/number_5.png[] Something within the application must <<servlet-authentication-form-custom,render the login page>>.
 
 [[servlet-authentication-usernamepasswordauthenticationfilter]]
 When the username and password are submitted, the `UsernamePasswordAuthenticationFilter` authenticates the username and password.
@@ -49,7 +49,7 @@ See the {security-api-url}springframework/security/web/authentication/Authentica
 
 image:{icondir}/number_4.png[] If authentication is successful, then __Success__.
 
-. `SessionAuthenticationStrategy` is notified of a new log in.
+. `SessionAuthenticationStrategy` is notified of a new login.
 See the {security-api-url}springframework/security/web/authentication/session/SessionAuthenticationStrategy.html[`SessionAuthenticationStrategy`] interface in the Javadoc.
 . The <<servlet-authentication-authentication>> is set on the <<servlet-authentication-securitycontextholder>>.
 See the {security-api-url}springframework/security/web/context/SecurityContextPersistenceFilter.html[`SecurityContextPersistenceFilter`] class in the Javadoc.
@@ -64,7 +64,7 @@ By default, Spring Security form login is enabled.
 However, as soon as any servlet-based configuration is provided, form based login must be explicitly provided.
 The following example shows a minimal, explicit Java configuration:
 
-.Form LogIn
+.Form Login
 ====
 .Java
 [source,java,role="primary"]
@@ -103,7 +103,7 @@ Most production applications require a custom login form.
 [[servlet-authentication-form-custom]]
 The following configuration demonstrates how to provide a custom login form.
 
-.Custom Log In Form Configuration
+.Custom Login Form Configuration
 ====
 .Java
 [source,java,role="primary"]
@@ -187,7 +187,7 @@ There are a few key points about the default HTML form:
 * If the HTTP parameter named `error` is found, it indicates the user failed to provide a valid username or password.
 * If the HTTP parameter named `logout` is found, it indicates the user has logged out successfully.
 
-Many users do not need much more than to customize the log in page.
+Many users do not need much more than to customize the login page.
 However, if needed, you can customize everything shown earlier with additional configuration.
 
 [[servlet-authentication-form-custom-controller]]

docs/manual/src/docs/asciidoc/_includes/servlet/kotlin-configuration/index.adoc

@@ -52,11 +52,10 @@ Note that this configuration is parallels the XML namespace configuration:
 
 We can configure multiple HttpSecurity instances, just as we can have multiple `<http>` blocks.
 The key is to extend the `WebSecurityConfigurerAdapter` multiple times.
-The following  example has a different configuration for URL's that start with `/api/`:
+The following example has a different configuration for URL's that start with `/api/`:
 
-// The source is Kotlin, but we specify Java to get code formatting. At present, Asciidoctor doesnt' have a Kotlin formatter.
 ====
-[source,java]
+[source,kotlin]
 ----
 @EnableWebSecurity
 class MultiHttpSecurityConfig {

docs/manual/src/docs/asciidoc/_includes/servlet/oauth2/oauth2-resourceserver.adoc

@@ -3,7 +3,7 @@
 :figures: images/servlet/oauth2
 :icondir: images/icons
 
-Spring Security supports protecting endpoints BY using two forms of OAuth 2.0 https://tools.ietf.org/html/rfc6750.html[Bearer Tokens]:
+Spring Security supports protecting endpoints by using two forms of OAuth 2.0 https://tools.ietf.org/html/rfc6750.html[Bearer Tokens]:
 
 * https://tools.ietf.org/html/rfc7519[JWT]
 * Opaque Tokens
@@ -1485,7 +1485,7 @@ This startup process is quite a bit simpler than for JWTs, since no endpoints ne
 Once the application has started, Resource Server tries to process any request containing an `Authorization: Bearer` header:
 
 ====
-[source,text]
+[source,http]
 ----
 GET / HTTP/1.1
 Authorization: Bearer some-token-value # Resource Server will process this
@@ -3026,7 +3026,7 @@ In these circumstances, Resource Server throws an `InvalidBearerTokenException`.
 Like other exceptions, this results in an OAuth 2.0 Bearer Token error response:
 
 ====
-[source,text]
+[source,http]
 ----
 HTTP/1.1 401 Unauthorized
 WWW-Authenticate: Bearer error_code="invalid_token", error_description="Unsupported algorithm of none", error_uri="https://tools.ietf.org/html/rfc6750#section-3.1"