anchor.diff:  %% TODO RBAC: to be removed
   get_role(_Req) ->
       none.
  -
  -%% applies given function F if current credentials allow access to at
  -%% least single SASL-auth bucket. So admin credentials and bucket
  -%% credentials works. Other credentials do not allow access. Empty
  -%% credentials are not allowed too.
  -apply_auth_any_bucket(Req, F, Args) ->
  -    case Req:get_header_value("ns-server-ui") of
  -        "yes" ->
  -            apply_ro_auth(Req, F, Args);
  -        _ ->
  -            UserPassword = extract_auth(Req),
  -            case check_auth_any_bucket(Req, UserPassword) of
  -                {true, NewReq} ->
  -                    apply(F, Args ++ [NewReq]);
  -                false ->
  -                    require_auth(Req)
  -            end
  -    end.
  -
  -store_bucket_auth(Req, Auth) ->
  -    {User, Role} = case Auth of
  -                       {UserX, _} ->
  -                           {UserX, bucket};
  -                       undefined ->
  -                           {undefined, undefined}
  -                   end,
  -    store_user_info(Req, User, Role, builtin, undefined).
  -
  -%% Checks if given credentials allow access to any SASL-auth
  -%% bucket.
  -check_auth_any_bucket(Req, Auth) ->
  -    case check_read_only_auth_no_ldap(Req, Auth) of
  -        {true, _NewReq} = RV ->
  -            RV;
  -        false ->
  -            Buckets = ns_bucket:get_buckets(),
  -            case lists:any(bucket_auth_fun(Auth), Buckets) of
  -                true ->
  -                    {true, store_bucket_auth(Req, Auth)};
  -                false ->
  -                    check_ldap(Req, Auth, [ro_admin, admin])
  -            end
  -    end.
  -
  -apply_auth_bucket(Req, F, Args, BucketId, ReadOnlyOk) ->
  -    case ns_bucket:get_bucket(BucketId) of
  -        {ok, BucketConf} ->
  -            case Req:get_header_value("ns-server-ui") of
  -                "yes" ->
  -                    case ReadOnlyOk of
  -                        true ->
  -                            apply_ro_auth(Req, F, Args);
  -                        false ->
  -                            apply_auth(Req, F, Args)
  -                    end;
  -                _ ->
  -                    Auth = extract_auth(Req),
  -                    case check_auth_bucket(Req, Auth, {BucketId, BucketConf}, ReadOnlyOk) of
  -                        {true, NewReq} ->
  -                            menelaus_web_buckets:checking_bucket_uuid(
  -                              NewReq, BucketConf,
  -                              fun () ->
  -                                      apply(F, Args ++ [NewReq])
  -                              end);
  -                        false ->
  -                            require_auth(Req)
  -                    end
  -            end;
  -        not_present ->
  -            menelaus_util:reply_not_found(Req)
  -    end.
  -
  -check_auth_bucket(Req, Auth, BucketTuple, ReadOnlyOk) ->
  -    RV = case ReadOnlyOk of
  -             true ->
  -                 check_read_only_auth_no_ldap(Req, Auth);
  -             false ->
  -                 check_admin_auth_no_ldap(Req, Auth)
  -         end,
  -    case RV of
  -        {true, _NewReq} ->
  -            RV;
  -        false ->
  -            F = bucket_auth_fun(Auth),
  -            case F(BucketTuple) of
  -                true ->
  -                    {true, store_bucket_auth(Req, Auth)};
  -                false ->
  -                    AllowedRoles = case ReadOnlyOk of
  -                                       true ->
  -                                           [ro_admin, admin];
  -                                       false ->
  -                                           [admin]
  -                                   end,
  -                    check_ldap(Req, Auth, AllowedRoles)
  -            end
  -    end.
  -
  -check_admin_auth(Req, Auth) ->
  -    case check_admin_auth_no_ldap(Req, Auth) of
  -        false ->
  -            check_ldap(Req, Auth, [admin]);
  -        RV ->
  -            RV
  -    end.
  -
  -check_admin_auth_no_ldap(Req, Auth) ->
  -    case check_admin_auth_int(Auth) of
  -        {true, User, Source, Token} ->
  -            {true, store_user_info(Req, User, admin, Source, Token)};
  -        false ->
  -            false
  -    end.
  -
  -%% checks if given credentials are admin credentials
  -check_admin_auth_int({token, Token}) ->
  -    case menelaus_ui_auth:check(Token) of
  -        {ok, {User, admin, Source}} ->
  -            {true, User, Source, Token};
  -        _ ->
  -            % An undefined user means no login/password auth check.
  -            case ns_config_auth:get_user(admin) of
  -                undefined ->
  -                    {true, undefined, undefined, Token};
  -                _ ->
  -                    false
  -            end
  -    end;
  -check_admin_auth_int({User, Password}) ->
  -    case ns_config_auth:authenticate(admin, User, Password) of
  -        true ->
  -            {true, User, builtin, undefined};
  -        false ->
  -            false
  -    end;
  -check_admin_auth_int(undefined) ->
  -    case ns_config_auth:get_user(admin) of
  -        undefined ->
  -            {true, undefined, undefined, undefined};
  -        _ ->
  -            false
  -    end.
  -
  -check_read_only_auth(Req, Auth) ->
  -    case check_read_only_auth_no_ldap(Req, Auth) of
  -        false ->
  -            check_ldap(Req, Auth, [ro_admin, admin]);
  -        RV ->
  -            RV
  -    end.
  -
  -check_read_only_auth_no_ldap(Req, Auth) ->
  -    case check_read_only_auth_int(Auth) of
  -        {true, User, Source, Token} ->
  -            {true, store_user_info(Req, User, ro_admin, Source, Token)};
  -        false ->
  -            check_admin_auth_no_ldap(Req, Auth)
  -    end.
  -
  -check_read_only_auth_int({token, Token}) ->
  -    case menelaus_ui_auth:check(Token) of
  -        {ok, {User, ro_admin, Source}} ->
  -            {true, User, Source, Token};
  -        _ ->
  -            false
  -    end;
  -check_read_only_auth_int({User, Password}) ->
  -    case ns_config_auth:authenticate(ro_admin, User, Password) of
  -        true ->
  -            {true, User, builtin, undefined};
  -        false ->
  -            false
  -    end;
  -check_read_only_auth_int(undefined) ->
  -    false.
   
   extract_auth_user(Req) ->
       case Req:get_header_value("authorization") of
  
positive.code:     undefined = Req:get_header_value("menelaus-auth-src"),
      undefined = Req:get_header_value("menelaus-auth-token").
  
  store_user_info(_Req, _User, _Role, _Source, _Token) ->
      erlang:error(to_be_deleted).
  
  store_user_info(Req, {User, Src}, Token) ->
      Headers = Req:get(headers),
      H1 = mochiweb_headers:enter("menelaus-auth-user", User, Headers),
  
negative.code:     [BucketName ||
          {BucketName, _Config} <- ns_bucket:get_buckets(),
          menelaus_roles:is_allowed(Fun(BucketName), Roles)].
  
  get_cookies(Req) ->
      case Req:get_header_value("Cookie") of
  