anchor.diff:                      authorized
               end;
           false ->
  +            %% It's not a modification request; allow it.
               authorized
       end.
   
  -config_for(cookbooks) ->
  -    custom_acls_cookbooks;
  -config_for(roles) ->
  -    custom_acls_roles;
  -config_for(data) ->
  -    custom_acls_data;
  -config_for(depsolver) ->
  -    custom_acls_depsolver.
  -
  -is_modification(depsolver, 'POST') ->
  -    false;
  -is_modification(_Endpoint, Method) when Method =:= 'GET';
  -                                        Method =:= 'HEAD' ->
  -    false;
  -is_modification(_Endpoint, _Method) ->
  -    true.
  -
  +%% @doc Determine the configuration parmeter that corresponds to the given endpoint.
  +config_for(cookbooks) -> custom_acls_cookbooks;
  +config_for(roles)     -> custom_acls_roles;
  +config_for(data)      -> custom_acls_data;
  +config_for(depsolver) -> custom_acls_depsolver.
  +
  +%% @doc Is the current request one that modifies the system, as determined by the endpoint
  +%% and HTTP verb being used?
  +is_modification(depsolver, 'POST')  -> false;
  +is_modification(_Endpoint, 'GET')   -> false;
  +is_modification(_Endpoint, 'HEAD')  -> false;
  +is_modification(_Endpoint, _Method) -> true.
  +
  +%% @doc Determine if we should use the authorization system for modification requests, or if
  +%% we should just follow the default ACL rules.  We only skip the check if [oc_chef_wm
  +%% custom_acls_always_for_modification] is explicitly set to false; undefined is the same as
  +%% true.
   auth_for_modification() ->
       case application:get_env(oc_chef_wm, custom_acls_always_for_modification) of
           {ok, Value} ->
               Value =:= true;
  -        _Else -> 
  -           true 
  +        _Else ->
  +           true
       end.
  -
  
positive.code:                       Req :: wrq:req(),
                        State :: #base_state{})
      -> {_, _, #base_state{}}.
  %% Check if we should use contact opscode-authz and chef requestor-specific acls for an endpoint.
  %% If the config variable is false, then we don't check the object/container ACLs and instead
  %% use the fact that a client has passed authn as allowing them to access a resource
  use_custom_acls(_Endpoint, Auth, Req, #base_state{requestor = #chef_user{} } = State) ->
      {Auth, Req, State};
  use_custom_acls(Endpoint, Auth, Req, #base_state{requestor = #chef_client{} } = State) ->
      case application:get_env(oc_chef_wm, config_for(Endpoint)) of
          {ok, false} ->
              {customize_for_modification_maybe(Endpoint, wrq:method(Req), Auth), Req, State};
          _Else -> %% use standard behaviour
              {Auth, Req, State}
      end.
  
  
negative.code: %%
  %% Controlled by the config variable {oc_chef_wm, custom_acls_always_for_modification}
  customize_for_modification_maybe(Endpoint, Method, Auth) ->
      %% If the current request is modifying the system, and we are configured to always use
      %% customized ACLs when servicing modification requests, defer to the authorization
      %% system to determine if this request should be authorized (i.e., allow the original
      %% `Auth' value to be used).  Otherwise, short-circuit and declare unilaterally that the
      %% request is authorized.
      case is_modification(Endpoint, Method) of
          true ->
              case auth_for_modification() of
  