anchor.diff:                    end,
           io:format("---val got authzId: ~p~n", [AuthzId]),
           AclState1 = AclState#acl_state{authz_id = AuthzId},
  -        {Req, State#base_state{resource_state = AclState1}}
  +        % TODO: check on this: I'm not sure this is what we really want; IIRC,
  +        % access is controlled by the ACLs so that (1) superuser will not
  +        % always have access and (2) I think access for ordinary users is not
  +        % limited to orgs.  This might work in practice, though, if ReqId is
  +        % passed through?
  +        {Req, State#base_state{resource_state = AclState1,
  +                               superuser_bypasses_checks = true}}
       catch
           throw:{not_found, Name} ->
               Message = chef_wm_util:not_found_message(Type, Name),
               Req1 = chef_wm_util:set_json_body(Req, Message),
  -            {{halt, 404}, Req1, State#base_state{log_msg = user_not_found}};
  -        throw:{forbidden, Name} ->
  -            % TODO: do a proper forbidden error message
  -            {{halt, 403}, Req, State}
  -    end.
  -
  -% TODO: don't like this; we only need the authz id, so grabbing complete objects
  -% is wastefull (particularly in the case of groups, where I believe all sorts of
  -% extra work is done for the subgroups and actors).  Also, this might be more
  -% suited to be moved to oc_chef_wm_util or something
  +            {{halt, 404}, Req1, State#base_state{log_msg = acl_not_found}}
  +    end.
  +
  +% TODO: don't like this; we only need the authz id, so grabbing complete
  +% objects is wasteful.  Also, this might be more suited to be moved to
  +% oc_chef_wm_util or something
   fetch_id(user, DbContext, Name, _OrgId) ->
       case chef_db:fetch(#chef_user{username = Name}, DbContext) of
           not_found ->
  
positive.code: allowed_methods(Req, State) ->
      {['GET', 'PUT'], Req, State}.
  
  validate_request(Method, Req, #base_state{chef_db_context = DbContext,
                                            requestor_id = RequestorId,
                                            organization_guid = OrgId,
                                            organization_name = OrgName,
                                            resource_state = #acl_state{type = Type} = 
                                                AclState} = State) when Method == 'GET';
                                                                        Method == 'PUT' ->
      io:format("---val ~p~n", [Method]),
      Name = chef_wm_util:object_name(Type, Req),
      io:format("---val got name: ~p~n", [Name]),
      try
          AuthzId = case Type of
                        group ->
                            fetch_group_id(DbContext, Name, OrgId, RequestorId);
                        cookbook ->
                            fetch_cookbook_id(DbContext, Name, OrgName);
                        Other ->
  
negative.code:     % TODO: implement; this is different than all the others
      error(not_implemented).
  
  % TODO: bespoke code; cookbooks retrieval is by orgname instead of ID
  fetch_cookbook_id(DbContext, Name, OrgName) ->
      % cookbook endpoint pattern is utterly different from the others, generic
      % fetch does not handle cookbooks (and, well, versioning)
      case chef_db:fetch_latest_cookbook_version(DbContext, OrgName, Name) of
          not_found ->
              throw({not_found, Name});
          {cookbook_exists, AuthzId} ->
              % unclear when this can happen; I assume for wrong version but
              % won't happen with 'latest' version?  But still checking for it
              % here.
              AuthzId;
          #chef_cookbook_version{authz_id = AuthzId} ->
              AuthzId
  