Important part below, in bold:
Next we need to update our tiny_uaa service with the new authorization configuration defined in the xs-security.json file. To do that you first need to download the xs-security.json file from your project in Web IDE to a folder accessible from your command line tool. Then, we will delete the service (which we provisioned in part 10 of this tutorial (Add authentication) for testing authentication) and recreate it with the new security definitions.
Run the following xs commands:
xs delete-service tiny_uaa
xs create-service xsuaa devuser tiny_uaa -c ./xs-security.json