anchor.diff:  t_assert_ldap(Count) ->
       ?assertEqual([{ldap_count, Count}], ets:lookup(state, ldap_count)).
   
  +t_assert_buckets(Expected, Actual) when is_atom(Actual) ->
  +    ?assertEqual(Expected, Actual);
   t_assert_buckets(Expected, Actual) ->
       t_print_ldap_count(),
       ActualNames = [Name || {Name, _} <- Actual],
  
positive.code:                  {{token, "ro_admin_token"}, BucketsAll, 0},
                   {{token, "ldap_admin_token"}, BucketsAll, 0},
                   {{token, "ldap_ro_token"}, BucketsAll, 0},
                   {{token, "wrong_token"}, [], 0},
                   %% this contradicts function description:
                   {[], ["b_empty_pass","b_noauth"], 0},
                   {{"b_auth", "pwd5"}, ["b_auth"], 0},
                   {{"b_noauth", ""}, ["b_noauth"], 0},
                   {{"b_empty_pass", ""}, ["b_empty_pass"], 0},
                   {{"b_noauth", "pwd"}, [], 1},
                   {{"b_empty_pass", "pwd"}, [], 1},
                   {{"b_auth", "wrong"}, [], 1},
                   {{"wrong", "wrong"}, [], 1}
                  ]].
  
  
  
negative.code: %% credentials
  filter_accessible_buckets(BucketsAll, Req) ->
      UserPassword = menelaus_auth:extract_auth(Req),
      case get_role(Req) of
          "admin" ->
              BucketsAll;
          "ro_admin" ->
              BucketsAll;
          _ ->
              F = bucket_auth_fun(UserPassword, true),
              [Bucket || Bucket <- BucketsAll, F(Bucket)]
      end.
  
  %% returns true if given bucket is accessible with current
  %% credentials. No auth buckets are always accessible. SASL auth
  