anchor.diff:  authz_id(#chef_user{authz_id = AuthzId}) ->
       AuthzId.
   
  --spec find_key_data(#chef_user{} | #chef_client{}) ->
  -    {cert, binary()} | {key, binary()}.
  -%% Some of Our user data lacks a certificate and has a public key
  -%% instead.  We look first for certificate, then for public_key.  If
  -%% both are not found, we'll crash with some detail of the badly
  -%% formed user record.
  -%%
  -find_key_data(#chef_user{public_key = KeyData, pubkey_version = ?CERT_VERSION}) ->
  -    {cert, KeyData};
  -find_key_data(#chef_user{public_key = KeyData, pubkey_version = ?KEY_VERSION}) ->
  -    {key, KeyData};
  -find_key_data(#chef_client{public_key = KeyData, pubkey_version = ?KEY_VERSION}) ->
  -    {key, KeyData};
  -find_key_data(#chef_client{public_key = KeyData}) ->
  -    %% FIXME: we should re-evaluate whether we need to track pubkey_version at all. For the
  -    %% types of key data in our current systems, we can easily detect the type by inspection
  -    %% of the key data. This could be done in the chef_authn layer.
  -    %%
  -    %% If not otherwise set, assume the key data is a certificate
  -    {cert, KeyData}.
  +-spec public_key(#chef_user{} | #chef_client{}) -> binary().
  +public_key(#chef_user{public_key = PublicKey}) ->
  +    PublicKey;
  +public_key(#chef_client{public_key = PublicKey}) ->
  +    PublicKey.
  
positive.code: %%% The webui public key is fetched from the chef_keyring service. The 'X-Ops-WebKey-Tag'
  %%% header specifies which key id to use, or we use the 'default' key if it is missing.
  %%%
  select_user_or_webui_key(Req, KeyData) ->
      %% Request origin is determined by the X-Ops-Request-Source header.  This is still secure
      %% because the request needs to have been signed with the webui private key.
      case wrq:get_req_header("x-ops-request-source", Req) of
  
negative.code:             {false, wrq:set_resp_body(ejson:encode(NotFoundMsg), Req),
               State#base_state{log_msg = {not_found, What}}};
          Requestor -> %% This is either #chef_client{} or #chef_user{}
              %% If the request originated from the webui, we do authn using the webui public
              %% key, not the user's key.
              PublicKey = select_user_or_webui_key(Req, Requestor),
              Body = body_or_default(Req, <<>>),
              HTTPMethod = method_as_binary(Req),
              Path = iolist_to_binary(wrq:path(Req)),
              {GetHeader, State1} = chef_wm_util:get_header_fun(Req, State),
              case chef_authn:authenticate_user_request(GetHeader, HTTPMethod,
                                                        Path, Body, PublicKey,
                                                        AuthSkew) of
                  {name, _} ->
                      {true, Req, State1#base_state{requestor_id = authz_id(Requestor),
  