anchor.diff:                  Password = ?l2b(Pass),
                   case authenticate(Password, UserProps) of
                       true ->
  -                        UserProps2 = maybe_upgrade_password_hash(
  -                            Req, UserName, Password, UserProps,
  -                            AuthModule, AuthCtx),
                           Req#httpd{user_ctx=#user_ctx{
                               name=UserName,
  -                            roles=couch_util:get_value(<<"roles">>, UserProps2, [])
  +                            roles=couch_util:get_value(<<"roles">>, UserProps, [])
                           }};
                       false ->
                           authentication_warning(Req, UserName),
  
positive.code:                 {[
                      {ok, true},
                      {name, UserName},
                      {roles, couch_util:get_value(<<"roles">>, UserProps2, [])}
                  ]});
          false ->
              authentication_warning(Req, UserName),
  
negative.code:     case authenticate(Password, UserProps) of
          true ->
              verify_totp(UserProps, Form),
              % setup the session cookie
              Secret = ?l2b(ensure_cookie_auth_secret()),
              UserSalt = couch_util:get_value(<<"salt">>, UserProps),
              CurrentTime = make_cookie_time(),
              Cookie = cookie_auth_cookie(Req, ?b2l(UserName), <<Secret/binary, UserSalt/binary>>, CurrentTime),
              % TODO document the "next" feature in Futon
  