anchor.diff:      {GetHeader, State1} = get_header_fun(Req, State),
       {Malformed, Req1, State2} =
           try
  -            chef_authn:validate_headers(GetHeader, 300),
  +            % chef_authn:validate_headers(GetHeader, 300),
               % transform query first to avoid possible db fetch for org
               % guid for bad queries
               Query = transform_query(wrq:get_qs_value("q", Req)),
  
positive.code:         end,
      {Malformed, Req1, State2}.
  
  verify_request_signature(Req, State) ->
      OrgName = wrq:path_info(organization_id, Req),
      UserName = wrq:get_req_header("x-ops-userid", Req),
      S = chef_otto:connect(),
      case chef_otto:fetch_user_or_client_cert(S, OrgName, UserName) of
          not_found ->
              NoCertMsg = bad_auth_message(no_cert),
              {false,
               wrq:set_resp_body(mochijson2:encode(NoCertMsg), Req), State};
          CertInfo ->
              Cert = ?gv(cert, CertInfo),
              OrgId = ?gv(org_guid, CertInfo, State#state.organization_guid),
              Body = body_or_default(Req, <<>>),
              HTTPMethod = iolist_to_binary(atom_to_list(wrq:method(Req))),
              Path = iolist_to_binary(wrq:path(Req)),
              {GetHeader, State1} = get_header_fun(Req, State),
              case chef_authn:authenticate_user_request(GetHeader, HTTPMethod,
                                                        Path, Body, Cert, 300) of
                  {name, _} ->
                      {true, Req,
                       State1#state{organization_guid = OrgId, couchbeam = S}};
                  {no_authn, Reason} ->
                      Msg = bad_auth_message(Reason),
                      Json = mochijson2:encode(Msg),
                      Req1 = wrq:set_resp_body(Json, Req),
                      {false, Req1, State1#state{couchbeam = S}}
              end
      end.
      
  is_authorized(Req, State) ->
      OrgName = wrq:path_info(organization_id, Req),
      UserName = wrq:get_req_header("x-ops-userid", Req),
      case verify_request_signature(Req,State) of
  	{true, Req1, State1} ->
  	    case chef_permissions:is_user_with_org(UserName, OrgName) of
  		true -> {true, Req1, State1};
  		false -> 
  		    Msg = bad_auth_message(not_member_of_org),
  		    Json = mochijson2:encode(Msg),
                      Req2 = wrq:set_resp_body(Json, Req),
  		    {false, Req2, State1}
  	    end;
  	Other -> Other
      end.	  
  
  body_or_default(Req, Default) ->
      case wrq:req_body(Req) of
  
negative.code:     end.
  
  transform_query(RawQuery) when is_binary(RawQuery) ->
      case chef_lucene:parse(RawQuery) of
          Query when is_binary(Query) ->
              ibrowse_lib:url_encode(binary_to_list(Query));
          _ ->
  