anchor.diff:      case Valid2 of
           ok ->
               %% add a source for each user
  -            put_meta(add_grant_int(UserList, Bucket, Grants, Meta)),
  +            put_meta(stash(epoch, {epoch, os:timestamp()},
  +                           add_grant_int(UserList, Bucket, Grants, Meta))),
               ok;
           Error ->
               Error
  
positive.code:                 [[Username, io_lib:format("~p", [Options])] ||
              {Username, Options} <- Users]).
  
  %% TODO a context should only be valid for a short time, eg. 5 seconds.
  %% Or perhaps every grant change should increment some value on the user
  %% information so we can detect when we need to re-pull the context.
  get_context(Username, Meta) ->
      Grants = lookup(Username, lookup(grants, Meta, []), []),
      Revokes = lookup(Username, lookup(revokes, Meta, []), []),
      {Username, Grants, Revokes, os:timestamp()}.
  
  check_permission(Permission, Bucket, Context) ->
      {_Username, Grants, Revokes, _Expiry} = Context,
      %% TODO check context is still valid
      case match_grant(Bucket, Grants) of
          {B, MatchG} ->
              case MatchG /= undefined andalso
                  (lists:member(Permission, MatchG) orelse MatchG == 'all') of
                  true ->
                      %% ok, permission is present, check for revokes
                      MatchR = lookup(B, Revokes, undefined),
                      case MatchR /= undefined andalso
                          (lists:member(Permission, MatchR) orelse MatchR == 'all') of
                          true ->
                              %% oh snap, it was revoked
                              {false, Context};
                          false ->
                              %% not revoked, yay
                              {true, Context}
                      end;
                  false ->
                      %% no applicable grant
                      {false, Context}
              end;
          undefined ->
              %% no grants for this user at all
              {false, Context}
      end.
  
  get_username({Username, _Grants, _Revokes, _Expiry}) ->
  
negative.code:         ok ->
              case add_revoke_int([all], Bucket, revokes, Meta) of
                  {ok, NewMeta} ->
                      put_meta(stash(epoch, {epoch, os:timestamp()}, NewMeta)),
                      ok;
                  Error2 ->
                      Error2
  