anchor.diff:      {[{<<"error">>, [<<"check clock">>]}]};
   error_json(bad_sign_desc) ->
       {[{<<"error">>, [<<"bad signing description">>]}]};
  -error_json(org_not_found) ->
  -    {[{<<"error">>, [<<"organization not found">>]}]};
  -error_json({bad_query, RawQuery}) ->
  -    {[{<<"error">>, [<<"invalid search query">>]},
  -              {<<"query">>, RawQuery}]};
  -error_json(not_member_of_org) ->
  -    {[{<<"error">>, [<<"Not a member of the organization">>]}]};
   error_json(_) ->
       {[{<<"error">>, [<<"problem with headers">>]}]}.
   
  
positive.code: 
  verify_request_signature(Req, State = #state{organization_name = OrgName}) ->
      UserName = wrq:get_req_header("x-ops-userid", Req),
      % TODO Quit leaking this
      S = chef_otto:connect(),
      case chef_otto:fetch_user_or_client_cert(S, OrgName, UserName) of
          not_found ->
              NoCertMsg = error_json(no_cert),
              {false,
               wrq:set_resp_body(ejson:encode(NoCertMsg), Req), State};
          CertInfo ->
              % TODO this causes us to fetch the organization a second time.  Keep it and pass it in instead.
              Cert = ?gv(cert, CertInfo),
              Body = body_or_default(Req, <<>>),
              HTTPMethod = iolist_to_binary(atom_to_list(wrq:method(Req))),
  
negative.code:         Body -> Body
      end.
  
  is_authorized_message(not_member_of_org, User, Org) ->
      Msg = iolist_to_binary([<<"'">>, User, <<"' not authorized to search '">>,
                              Org, <<"'.">>]),
      {[{<<"error">>, [Msg]}]};
  is_authorized_message(org_not_found, _User, Org) ->
      Msg = iolist_to_binary([<<"organization '">>, Org,
                              <<"' does not exist.">>]),
      {[{<<"error">>, [Msg]}]}.
  
  
  verify_request_message({not_found, client}, User, _Org) ->
      Msg = iolist_to_binary([<<"Failed to authenticate as '">>, User, <<"'. ">>,
                              <<"Ensure that your node_name and client key ">>,
                              <<"are correct.">>]),
      {[{<<"error">>, [Msg]}]};
  verify_request_message({not_found, org}, _User, Org) ->
      Msg = iolist_to_binary([<<"organization '">>, Org,
                              <<"' does not exist.">>]),
      {[{<<"error">>, [Msg]}]}.
  
  
  error_json(bad_sig) ->
      {[{<<"error">>, [<<"bad signature">>]}]};
  error_json(no_cert) ->
  %% {\"error\":[\"Failed to authenticate as seth-xxx-yyy. Ensure that your node_name and client key are correct.\"]}"}
      {[{<<"error">>, [<<"user, client, or organization not found">>]}]};
  error_json({missing_headers, Missing}) ->
      {[{<<"error">>,
  