anchor.diff:  forbidden(Req, #base_state{resource_mod=Mod}=State) ->
       case Mod:auth_info(Req, State) of
           {{halt, 403}, Req1, State1} ->
  -            Perm = http_method_to_authz_perm(wrq:method(Req)),
  -            Msg = iolist_to_binary(["missing ", atom_to_binary(Perm, utf8),
  -                                    " permission"]),
  -            JsonMsg = ejson:encode({[{<<"error">>, [Msg]}]}),
  -            Req1 = wrq:set_resp_body(JsonMsg, Req),
  -            {true, Req1, State1#base_state{log_msg = {Perm, forbidden}}};
  +            forbidden_perm(Req1, State1);
           {{halt, Code}, Req1, State1} ->
               {{halt, Code}, Req1, State1};
           {container, ContainerId, Req1, State1} ->
  
positive.code: check_permission(AuthzObjectType, AuthzId, Req, #base_state{reqid=ReqId,
                                                              requestor=Requestor}=State) ->
      #chef_requestor{authz_id = RequestorId} = Requestor,
      Perm = http_method_to_authz_perm(wrq:method(Req)),
      case ?SH_TIME(ReqId, chef_authz, is_authorized_on_resource,
                    (RequestorId, AuthzObjectType, AuthzId, actor, RequestorId, Perm)) of
          true ->
              {true, Req, State};
          false ->
              Msg = iolist_to_binary(["missing ", atom_to_binary(Perm, utf8),
                                      " permission"]),
              JsonMsg = ejson:encode({[{<<"error">>, [Msg]}]}),
              %% eventually we might want to customize the error message, for now, we'll go
              %% with the generic message.
              %% {Req1, State1} = ErrorMsgFun(Req, State),
              Req1 = wrq:set_resp_body(JsonMsg, Req),
              {false, Req1, State#base_state{log_msg = {Perm, forbidden}}};
          Error ->
              error_logger:error_msg("is_authorized_on_resource failed (~p, ~p, ~p): ~p~n",
                                     [Perm, {AuthzObjectType, AuthzId}, RequestorId, Error]),
  
negative.code:               {upstream_prefixes, [<<"rdbms">>, <<"couch">>, <<"authz">>, <<"solr">>]}],
      stats_hero_worker_sup:new_worker(Config).
  
  http_method_to_authz_perm(#wm_reqdata{}=Req) ->
      http_method_to_authz_perm(wrq:method(Req));
  http_method_to_authz_perm('DELETE') ->
      delete;
  http_method_to_authz_perm('GET') ->
  