anchor.diff:      {ok, Token} = macaroon:serialize(M3),
       {Token, Public, Secret}.
   
  --spec priv_check_payload(binary(), binary(), binary(), map()) -> ok | {error, invalid_token}.
  +-spec priv_check_payload(User, SessionToken, Payload, State) ->
  +                                ok | {error, invalid_token}
  +                                    when User :: binary(),
  +                                         SessionToken :: binary(),
  +                                         Payload :: binary(),
  +                                         State :: map().
   priv_check_payload(_User, _SessionToken, _Payload, State)
     when map_size(State) == 0 ->
       {error, invalid_session_token};
  
positive.code: %%                                  {error, invalid_path}.
  %% @end
  %%--------------------------------------------------------------------
  -spec new_session(binary(), binary()) -> {ok, binary()} |
                                           {error, invalid_user} |
                                           {error, invalid_path}.
  new_session(User, Path) ->
      gen_server:call(?MODULE, {proc_req, new_session, {User, Path}}).
  
  
negative.code: %%% Internal functions
  %%%===================================================================
  
  -spec priv_new_session(User, Path) -> {ok, Token} |
                                        {error, invalid_user} |
                                        {error, invalid_path}
                                            when User :: binary(),
                                                 Path :: binary(),
                                                 Token :: binary().
  priv_new_session(User, Path) ->
      % Check if user is registered with the cvmfs_auth service and which
      % paths he is allowed to modify
  