anchor.diff:    end.
   
   valid_user_data() ->
  -    {[{<<"password">>, {string_match, chef_regex:regex_for(non_blank_string)}} ]}.
  +    {[{<<"username">>, {string_match, chef_regex:regex_for(non_blank_string)}},
  +      {<<"password">>, {string_match, chef_regex:regex_for(non_blank_string)}}]}.
   
   auth_info(Req, #base_state{ resource_state = #user_state{user_data = UserData}} = State) ->
       %% Disallow any attempts to authenticate with credentials of
  
positive.code:           throw({error, missing_body});
        Body ->
            UserData = ejson:decode(Body),
            chef_user:validate_user_name(UserData),
            case ej:valid(valid_user_data(), UserData) of
                ok ->
                    UserState1 = UserState#user_state{user_data = UserData},
  
negative.code:             {true, chef_wm_util:set_json_body(Req, EJson), State}
      end.
  
  verify_user(Password, #chef_user{recovery_authentication_enabled = true} = User, _Ctx) ->
      PasswordData = chef_user:password_data(User),
      case chef_password:verify(Password, PasswordData) of
          true ->
              user_json(User);
          false ->
              {false, 401}
      end;
  verify_user(_Password, _Other, _Ctx) ->
      {false, 403}.
  
  user_json(User) ->
      UserEJ0 = chef_user:assemble_user_ejson(User, undefined),
      UserEJ1 = ej:delete({<<"public_key">>}, UserEJ0),
      UserEJ2 = ej:set({<<"recovery_authentication_enabled">>}, UserEJ1, true),
      UserEJ2.
  
  malformed_request_message({error, missing_body}, _Req, _State) ->
  