anchor.diff:      end.
   
   cookie_auth_header(#httpd{user_ctx=#user_ctx{name=null}}, _Headers) -> [];
  -cookie_auth_header(#httpd{user_ctx=#user_ctx{name=User}, auth={Secret, true}}, Headers) ->
  +cookie_auth_header(#httpd{user_ctx=#user_ctx{name=User}, auth={Secret, true}}=Req, Headers) ->
       % Note: we only set the AuthSession cookie if:
       %  * a valid AuthSession cookie has been received
       %  * we are outside a 10% timeout window
  
positive.code:     AuthSession = couch_util:get_value("AuthSession", Cookies),
      if AuthSession == undefined ->
          TimeStamp = make_cookie_time(),
          [cookie_auth_cookie(?b2l(User), Secret, TimeStamp)];
      true ->
          []
      end;
  cookie_auth_header(_Req, _Headers) -> [].
  
  cookie_auth_cookie(User, Secret, TimeStamp) ->
      SessionData = User ++ ":" ++ erlang:integer_to_list(TimeStamp, 16),
      Hash = crypto:sha_mac(Secret, SessionData),
      mochiweb_cookies:cookie("AuthSession",
          couch_util:encodeBase64Url(SessionData ++ ":" ++ ?b2l(Hash)),
          [{path, "/"}, {http_only, true}]). % TODO add {secure, true} when SSL is detected
  
  hash_password(Password, Salt) ->
      ?l2b(couch_util:to_hex(crypto:sha(<<Password/binary, Salt/binary>>))).
  
negative.code:                 ]});
          _Else ->
              % clear the session
              Cookie = mochiweb_cookies:cookie("AuthSession", "", [{path, "/"}, cookie_scheme(Req)]),
              send_json(Req, 401, [Cookie], {[{error, <<"unauthorized">>},{reason, <<"Name or password is incorrect.">>}]})
      end;
  % get user info
  