anchor.diff:  -export([handle/1]).
   -include("tts.hrl").
   
  -handle(#{path := ep_redirect } = ReqMap) ->
  -    redirect_to_auth_server(ReqMap);
  -handle(#{path := ep_return} = ReqMap) ->
  -    login_user_with_authcode(ReqMap);
   handle(#{path := ep_main, logged_in := true} = ReqMap) ->
       redirect_to(user_page, ReqMap);
   handle(#{path := ep_user, method := post, logged_in := true} = ReqMap) ->
  
positive.code:     show_user_page(Session, false, [], false).
  
  
  request_credential(#{session := Session, session_id := SessionId,
                       body_qs:= #{ service_id:=ServiceId}}) ->
      {ok, Issuer, Subject} = tts_session:get_iss_sub(Session),
      {ok, UserInfo} = tts_user_cache:get_user_info(Issuer, Subject),
      {ok, Token} = tts_session:get_token(Session),
      true = tts_service:is_enabled(ServiceId),
      Iface = <<"web interface">>,
      case  tts_credential:request(ServiceId, UserInfo, Iface, Token, []) of
          {ok, Credential, Log} ->
              [#{name := id, value:=CredId}|_] = Credential,
              lager:info("~p: requested credential ~p",
                         [SessionId, CredId]),
              show_user_page(Session, Credential, Log, false);
          {error, Reason, Log} ->
              lager:warning("~p: credential request for ~p failed with ~p",
                         [SessionId, ServiceId, Reason]),
              ErrMsg = <<"failed to request credential">>,
              show_user_page(Session, false, Log, ErrMsg)
      end;
  
negative.code:     redirect_to(ep_main, ReqMap).
  
  
  show_select_page(ReqMap) ->
      {ok, OpList} = tts:get_openid_provider_list(),
      Error = maps:get(error, ReqMap, undefined),
      {ok, Version} = application:get_key(tts, vsn),
      {ok, Body} = tts_main_dtl:render([{ep_redirect, ?CONFIG(ep_redirect)},
  