anchor.diff:  
   -export([
       decode_body/3,
  -    success_response/2,
  -    success_response/3,
  -    error_response/3,
  -    set_body_message/2,
  -    sendfile/4,
  -    add_cors_headers/1,
  -    check_design_token/1,
  -    check_admin_token/1
  +    add_cors_headers/1
   ]).
   
   -define(INVALID_JSON, <<"Invalid json">>).
  
positive.code:     lists:foldl(fun({Name, Value}, R) ->
          cowboy_req:set_resp_header(Name, Value, R)
      end, Req, Headers).
  
  check_design_token(Req) ->
      % Grab token from authorization header
      case cowboy_req:parse_header(<<"authorization">>, Req) of
          {_, {<<"token">>, TokenData}, _} ->
              parse_and_validate_design_token(Req, TokenData);
          _ ->
              invalid_header
      end.
  
  check_admin_token(Req) ->
      % Grab token from authorization header
      case cowboy_req:parse_header(<<"authorization">>, Req) of
          {_, {<<"token">>, TokenData}, _} ->
              parse_and_validate_admin_token(TokenData);
          _ ->
              invalid_header
      end.
  
  parse_and_validate_design_token(Req, TokenData) ->
      case get_token(<<"design">>, TokenData) of
          {ok, Token} ->
              {Value, _} = cowboy_req:binding(id, Req),
              DesignId = binary_to_integer(Value),
              TokenHash = util:sha1(Token),
              design_model:lookup_design_token(DesignId, TokenHash);
          Invalid ->
              Invalid
      end.
  
  parse_and_validate_admin_token(TokenData) ->
      case get_token(<<"admin">>, TokenData) of
          {ok, Token} ->
              TokenHash = util:sha1(Token),
              design_model:lookup_admin_token(TokenHash);
          Invalid ->
              Invalid
      end.
  
  get_token(Type, TokenData) ->
      case parse_token(TokenData) of
          {ok, Parsed} ->
              case proplists:get_value(<<"type">>, Parsed) of
                  Type -> {ok, proplists:get_value(<<"value">>, Parsed, <<"">>)};
                  undefined -> wrong_type;
                  _ -> wrong_type
              end;
          Invalid -> Invalid
      end.
  
  parse_token(Data) ->
      case binary:split(Data, <<" ">>) of
          [First, Second] ->
              {ok, [parse_token_kv(First), parse_token_kv(Second)]};
          _ -> no_parse
      end.
  
  parse_token_kv(Data) ->
      case binary:split(util:trim(Data), <<"=">>) of
          [Key, QuotedValue] -> {Key, util:unquote(QuotedValue)};
          _ -> no_parse
      end.
  
negative.code:             {halt, Req3, State}
      end.
  
  add_cors_headers(Req) ->
      Headers = [
          {<<"access-control-allow-methods">>, <<"POST, OPTIONS">>},
  