anchor.diff:              {false, wrq:set_resp_body(ejson:encode(NotFoundMsg), Req),
                State#base_state{log_msg = {not_found, What}}};
           Requestor -> %% This is either #chef_client{} or #chef_user{}
  -            KeyData0 = find_key_data(Requestor),
               %% If the request originated from the webui, we do authn using the webui public
               %% key, not the user's key.
  -            KeyData = select_user_or_webui_key(Req, KeyData0),
  +            PublicKey = select_user_or_webui_key(Req, Requestor),
               Body = body_or_default(Req, <<>>),
               HTTPMethod = method_as_binary(Req),
               Path = iolist_to_binary(wrq:path(Req)),
               {GetHeader, State1} = chef_wm_util:get_header_fun(Req, State),
               case chef_authn:authenticate_user_request(GetHeader, HTTPMethod,
  -                                                      Path, Body, KeyData,
  +                                                      Path, Body, PublicKey,
                                                         AuthSkew) of
                   {name, _} ->
                       {true, Req, State1#base_state{requestor_id = authz_id(Requestor),
  
positive.code:                     throw({no_such_key, WebKeyTag})
              end;
          _Else ->
              KeyData
      end.
  
  -spec body_not_too_big(#wm_reqdata{}) -> #wm_reqdata{}.
  
negative.code: authz_id(#chef_user{authz_id = AuthzId}) ->
      AuthzId.
  
  -spec public_key(#chef_user{} | #chef_client{}) -> binary().
  public_key(#chef_user{public_key = PublicKey}) ->
      PublicKey;
  public_key(#chef_client{public_key = PublicKey}) ->
      PublicKey.
  