anchor.diff:  get_stats() ->
       riak_cs_stats:get_stats().
   
  -path_tokens(RD) ->
  -    wrq:path_tokens(RD).
  +%% -------------------------------------------------------------------
  +%% Internal functions
  +%% -------------------------------------------------------------------
  +
  +forbidden(RD, Ctx, undefined, true) ->
  +    {false, RD, Ctx};
  +forbidden(RD, Ctx, undefined, false) ->
  +    %% anonymous access disallowed
  +    riak_cs_wm_utils:deny_access(RD, Ctx);
  +forbidden(RD, Ctx, User, false) ->
  +    UserKeyId = User?RCS_USER.key_id,
  +    case riak_cs_config:admin_creds() of
  +        {ok, {Admin, _}} when Admin == UserKeyId ->
  +            %% admin account is allowed
  +            riak_cs_dtrace:dt_wm_return(?MODULE, <<"forbidden">>,
  +                                        [], [<<"false">>, Admin]),
  +            {false, RD, Ctx};
  +        _ ->
  +            %% non-admin account is not allowed -> 403
  +            Res = riak_cs_wm_utils:deny_access(RD, Ctx),
  +            riak_cs_dtrace:dt_wm_return(?MODULE, <<"forbidden">>, [], [<<"true">>]),
  +            Res
  +    end.
  
positive.code:         true ->
              case riak_cs_utils:riak_connection() of
                  {ok, Pid} ->
                      {true, RD, Ctx#ctx{riakc_pid = Pid}};
                  _ ->
                      {false, RD, Ctx}
              end
      end;
  service_available(RD, Ctx) ->
      riak_cs_dtrace:dt_wm_entry(?MODULE, <<"service_available">>),
      {false, RD, Ctx}.
  
  produce_body(RD, Ctx) ->
      riak_cs_dtrace:dt_wm_entry(?MODULE, <<"produce_body">>),
  
negative.code:       {"text/plain", pretty_print}],
       RD, Context}.
  
  service_available(RD, Ctx) ->
      riak_cs_dtrace:dt_wm_entry(?MODULE, <<"service_available">>),
      case riak_cs_config:riak_cs_stat() of
          false ->
  