anchor.diff:  %% we add a user to the org, and then disassociate them, there will be
   %% acls left behind granting permissions on the org objects, so we
   %% must check user association and permissions
  -authorized_by_org_membership_check(Req, #base_state{requester_type=client}=State) ->
  +authorized_by_org_membership_check(Req, #base_state{requestor=#chef_client{}}=State) ->
       {true, Req, State};
   authorized_by_org_membership_check(Req, State = #base_state{organization_name = OrgName,
                                                               chef_db_context = DbContext}) ->
  
positive.code: %%                      Req :: wm_req(),
  %%                      State :: #base_state{}) -> true | false | Error :: term().
  has_permission(AuthzObjectType, AuthzId, Permission, Req, #base_state{reqid=ReqId,
                                                                        requestor=Requestor}=State) ->
      #chef_requestor{authz_id = RequestorId} = Requestor,
      ?SH_TIME(ReqId, chef_authz, is_authorized_on_resource,
                    (RequestorId, AuthzObjectType, AuthzId, actor, RequestorId, Permission)).
  
  %% NOTE: derives the permission check from the HTTP verb of the Request
  check_permission(AuthzObjectType, AuthzId, Req, #base_state{reqid=ReqId,
                                                              requestor=#chef_requestor{
                                                                authz_id = RequestorId}
                                                             }=State) ->
      Perm = http_method_to_authz_perm(Req),
      case has_permission(AuthzObjectType, AuthzId, Perm, Req, State) of
  
negative.code:                     {Req2, State2} = set_forbidden_msg(Permission, Req1, State1),
                      {true, Req2, State2};
                  {Error, {AuthzObjectType, AuthzId, Permission}} ->
                      #base_state{requestor_id=RequestorId} = State1,
                      %% TODO: Extract this logging message, as it is used elsewhere, too
                      error_logger:error_msg("is_authorized_on_resource failed (~p, ~p, ~p): ~p~n",
                                             [Permission, {AuthzObjectType, AuthzId}, RequestorId, Error]),
  