anchor.diff:  
   is_authorized(Req, #state{type=oidcp} = State) ->
       {true, Req, State};
  -is_authorized(Req, #state{issuer=Issuer} = State) when not is_binary(Issuer) ->
  -    {{false, <<"Authorization">>}, Req, State};
  -is_authorized(Req, #state{token=Token} = State) when not is_binary(Token) ->
  -    {{false, <<"Authorization">>}, Req, State};
   is_authorized(Req, #state{type=Type, token=Token, issuer=Issuer} = State)
     when Type==service; Type==credential; Type==cred_data ->
  -    try
  -        {ok, ProviderId} = oidcc:find_openid_provider(Issuer),
  -        {ok, #{issuer := Issuer}} = oidcc:get_openid_provider_info(ProviderId),
  -        {ok, #{sub := Subject}} = oidcc:retrieve_user_info(Token, ProviderId),
  -        {ok, UserInfo} = tts_user_cache:get_user_info(Issuer, Subject, Token),
  -        {true, Req, State#state{user_info=UserInfo}}
  -    catch _:_ -> {{false, <<"Authorization">>}, Req, State}
  +    case tts:login_with_access_token(Token, Issuer) of
  +        {ok, #{session_pid := SessionPid}} ->
  +            {true, Req, State#state{session_pid = SessionPid}};
  +        {error, _} ->
  +            {{false, <<"Authorization">>}, Req, State}
  +
       end;
   is_authorized(Req, State) ->
       {{false, <<"Authorization">>}, Req, State}.
  
positive.code:           version = undefined,
            type = undefined,
            id = undefined,
            token = undefined,
            issuer = undefined,
            object = undefined,
            provider = undefined,
            json = undefined,
            user_info = undefined
           }).
  
  rest_init(Req, _Opts) ->
  
negative.code:    (Version =< 0) or (Version > ?LATEST_VERSION);
  is_bad_version(_) ->
      true.
  