anchor.diff:  create_user(Name, Email, KeyId, Secret) ->
       case validate_email(Email) of
           ok ->
  -            User = user_record(Name, Email, KeyId, Secret),
  +            CanonicalId = generate_canonical_id(KeyId),
  +            User = user_record(Name, Email, KeyId, Secret, CanonicalId),
               create_credentialed_user(riak_cs_config:admin_creds(), User);
           {error, _Reason}=Error ->
               Error
  
positive.code: 
  %% @doc Return a user record for the specified user name and
  %% email address.
  -spec user_record(string(), string(), string(), string()) -> rcs_user().
  user_record(Name, Email, KeyId, Secret) ->
      user_record(Name, Email, KeyId, Secret, []).
  
  %% @doc Return a user record for the specified user name and
  %% email address.
  -spec user_record(string(), string(), string(), string(), [cs_bucket()]) ->
                           rcs_user().
  user_record(Name, Email, KeyId, Secret, Buckets) ->
      CanonicalId = generate_canonical_id(KeyId, Secret),
      DisplayName = display_name(Email),
      ?RCS_USER{name=Name,
                display_name=DisplayName,
  
negative.code:     {KeyId, Secret}.
  
  %% @doc Generate the canonical id for a user.
  -spec generate_canonical_id(string()) -> string().
  generate_canonical_id(KeyID) ->
      Bytes = 16,
      Id1 = riak_cs_utils:md5(KeyID),
      Id2 = riak_cs_utils:md5(druuid:v4()),
      riak_cs_utils:binary_to_hexlist(
        iolist_to_binary(<< Id1:Bytes/binary,
                            Id2:Bytes/binary >>)).
  