anchor.diff:              case check_auth_any_bucket(Req, UserPassword) of
                   {true, NewReq} ->
                       apply(F, Args ++ [NewReq]);
  -                _ ->
  -                    %% this is needed to cover the case when there's no buckets
  -                    apply_ro_auth(Req, F, Args)
  +                false ->
  +                    require_auth(Req)
               end
       end.
   
  
positive.code: check_auth_bucket(Req, Auth, BucketTuple, ReadOnlyOk) ->
      RV = case ReadOnlyOk of
               true ->
                   check_read_only_auth(Req, Auth);
               false ->
                   check_admin_auth(Req, Auth)
           end,
      case RV of
          {true, _NewReq} ->
              RV;
          false ->
              F = bucket_auth_fun(Auth, ReadOnlyOk),
              case F(BucketTuple) of
                  true ->
                      {true, store_bucket_auth(Req, Auth)};
                  false ->
                      false
              end
      end.
  
  check_auth(Auth) ->
      case check_admin_auth_int(Auth) of
          {true, _User, _Source, _Token} ->
              true;
          false ->
              false
      end.
  
  check_admin_auth(Req, Auth) ->
      case check_admin_auth_int(Auth) of
          {true, User, Source, Token} ->
              {true, store_user_info(Req, User, admin, Source, Token)};
  
negative.code: %%
  %% NOTE: that no-auth buckets are always accessible even without
  %% password at all
  bucket_auth_fun(Auth) ->
      fun ({BucketName, BucketProps}) ->
              case {proplists:get_value(auth_type, BucketProps),
                    proplists:get_value(sasl_password, BucketProps),
                    Auth} of
                  {none, _, undefined} ->
                      true;
                  {none, _, {BucketName, ""}} ->
                      true;
                  {sasl, "", undefined} ->
                      true;
                  {sasl, BucketPassword, {BucketName, BucketPassword}} ->
                      true;
                  _ ->
                      false
              end
      end.
  
  is_under_role(Req, Role) when is_atom(Role) ->
      get_role(Req) =:= atom_to_list(Role).
  
  check_ldap(Req, Auth, AllowedRoles) ->
      case check_ldap_int(Auth, AllowedRoles) of
          {true, User, Role} ->
              {true, store_user_info(Req, User, Role, saslauthd, undefined)};
          false ->
              false
      end.
  
  check_ldap_int({token, _Token}, _) ->
      false;
  check_ldap_int({User, Password}, AllowedRoles) ->
      Role = saslauthd_auth:check(User, Password),
      case lists:member(Role, AllowedRoles) of
          true ->
              {true, User, Role};
          false ->
              false
      end;
  check_ldap_int(undefined, _) ->
      false.
  
  verify_login_creds(User, Password) ->
      case ns_config_auth:authenticate(admin, User, Password) of
  