anchor.diff:  content_types_provided(Req, State) ->
       {[{{<<"application">>, <<"json">>, '*'}, to_json}], Req, State}.
   
  +is_authorized(Req, State=#state{body_set=false}) ->
  +    try_fill_body(Req, State);
   is_authorized(Req, State=#state{access=Access, info=Info}) ->
  -     case iorio_session:fill_session(Req, Access, Info) of
  -         {ok, Req1, Info1} ->
  -             State1 = State#state{info=Info1},
  -             Action = ?PERM_ADMIN_USERS,
  +    Action = ?PERM_ADMIN_USERS,
   
  -             case ioriol_access:is_authorized_for_bucket(Access, Info1, Action) of
  -                 {ok, Info2} ->
  -                     {true, Req1, State1#state{info=Info2}};
  -                 {error, Reason} ->
  -                     unauthorized_response(Req1, State1, Reason)
  -             end;
  -         {error, Reason, Req1} ->
  -             unauthorized_response(Req1, State, Reason)
  -     end.
  -
  -action_from_req(Req) ->
  -    {Method, Req1} = cowboy_req:method(Req),
  -    case Method of
  -        <<"POST">> -> {create_user, Req1};
  -        <<"PUT">> -> {update_user_password, Req1}
  +    case ioriol_access:is_authorized_for_bucket(Access, Info, Action) of
  +        {ok, Info1} ->
  +            {true, Req, State#state{info=Info1}};
  +        {error, Reason} ->
  +            unauthorized_response(Req, State, Reason)
       end.
   
  -from_json(Req, State=#state{access=Access}) ->
  -    {ok, BodyRaw, Req1} = cowboy_req:body(Req),
  -    try
  -        Body = iorio_json:decode_plist(BodyRaw),
  -        Username = proplists:get_value(<<"username">>, Body),
  -        Password = proplists:get_value(<<"password">>, Body),
  -
  -        {Action, Req2} = action_from_req(Req),
  -        {Ok, Req3} = do_action(Access, Username, Password, Req2, Action),
  -        {Ok, Req3, State}
  -    catch
  -        error:badarg -> {false, iorio_http:invalid_body(Req1), State}
  -    end.
  +from_json(Req, State=#state{access=Access, username=Username, password=Password}) ->
  +    {Action, Req1} = action_from_req(Req),
  +    {Ok, Req3} = do_action(Access, Username, Password, Req1, Action),
  +    {Ok, Req3, State}.
   
   to_json(Req, State=#state{access=Access}) ->
       {ok, Users} = ioriol_access:users(Access),
  
positive.code: 
  do_action(Access, Username, Password, Req, Action) ->
      lager:info("~p'ing user '~s'", [Action, Username]),
      case {Action, ioriol_access:Action(Access, Username, Password)} of
          {create_user, ok} ->
              ioriol_access:maybe_grant_bucket_ownership(Access, Username),
              UriStr = io_lib:format("/users/~s", [Username]),
  
negative.code: 
  -include("include/iorio.hrl").
  
  -record(state, {access, info, method, body_set=false, username, password}).
  
  init({tcp, http}, _Req, _Opts) -> {upgrade, protocol, cowboy_rest};
  init({ssl, http}, _Req, _Opts) -> {upgrade, protocol, cowboy_rest}.
  