anchor.diff:                                                        Path, Body, Cert, 300) of
                   {name, _} ->
                       {true, Req,
  -                     State1#state{couchbeam = S}};
  +                     State1#state{couchbeam = S,
  +                                  organization_guid = ?gv(org_guid, CertInfo)}};
                   {no_authn, Reason} ->
                       Msg = error_json(Reason),
                       Json = ejson:encode(Msg),
                       Req1 = wrq:set_resp_body(Json, Req),
  -                    % TODO This is a needless mutation
  -                    {false, Req1, State1#state{couchbeam = S}}
  +                    {false, Req1, State1}
               end
       end.
   
  
positive.code:     {[{<<"error">>, [<<"check clock">>]}]};
  error_json(bad_sign_desc) ->
      {[{<<"error">>, [<<"bad signing description">>]}]};
  error_json(org_not_found) ->
      {[{<<"error">>, [<<"organization not found">>]}]};
  error_json({bad_query, RawQuery}) ->
      {[{<<"error">>, [<<"invalid search query">>]},
                {<<"query">>, RawQuery}]};
  error_json(not_member_of_org) ->
      {[{<<"error">>, [<<"Not a member of the organization">>]}]};
  error_json(_) ->
      {[{<<"error">>, [<<"problem with headers">>]}]}.
  
  
negative.code: 
  verify_request_signature(Req, State = #state{organization_name = OrgName}) ->
      UserName = wrq:get_req_header("x-ops-userid", Req),
      S = chef_otto:connect(),
      case chef_otto:fetch_user_or_client_cert(S, OrgName, UserName) of
          {not_found, What} ->
              NotFoundMsg = verify_request_message({not_found, What},
                                                   UserName, OrgName),
              {false, wrq:set_resp_body(ejson:encode(NotFoundMsg), Req), State};
          CertInfo ->
              %% TODO this causes us to fetch the organization a second
              %% time.  Keep it and pass it in instead.
              Cert = ?gv(cert, CertInfo),
              Body = body_or_default(Req, <<>>),
              HTTPMethod = iolist_to_binary(atom_to_list(wrq:method(Req))),
  