anchor.diff:  -include("chef_types.hrl").
   -include_lib("ej/include/ej.hrl").
   
  -
   -behaviour(chef_object).
  +
  +
  +%% Whitelist of fields we will persist to serialized_object.  Fields not in the list
  +%% will not be persisted in create and update operations.
  +-define(JSON_SERIALIZABLE, [<<"display_name">>,
  +                            <<"first_name">>,
  +                            <<"last_name">>,
  +                            <<"middle_name">>,
  +                            <<"city">>,
  +                            <<"country">>,
  +                            <<"twitter_account">>,
  +                            <<"image_file_name">>]).
   
   -spec authz_id(#chef_user{}) -> object_id().
   authz_id(#chef_user{authz_id = AuthzId}) ->
  
positive.code:     ExtAuthUid = value_or_null({<<"external_authentication_uid">>}, UserData),
      EnableRecovery = ej:get({"<<recovery_authentication_enabled>>"}, UserData) =:= true,
      {PublicKey, PubkeyVersion} = chef_object_base:cert_or_key(UserData),
      SerializedObject = { whitelisted_values(UserData) },
      #chef_user{id = Id,
                 authz_id = chef_object_base:maybe_stub_authz_id(AuthzId, Id),
                 username = Name,
  
negative.code: valid_password(_Password) ->
      error.
  
  %% Returns the subset of permitted fields that are present in in the request.
  whitelisted_values(EJ, Permitted) ->
      [{X, ej:get({X}, EJ) } || X <- Permitted, ej:get({X}, EJ)  =/= undefined ].
  
  assemble_user_ejson(#chef_user{username = Name,
                                 public_key = KeyOrCert,
                                 email = Email,
                                 serialized_object = SerializedObject},
                      _OrgId) ->
      EJ = chef_json:decode(SerializedObject ),
      % public_key can mean either public key or cert.
      % if it's a cert, we need to extract the public key -
      % we don't want to hand the cert back on user GET.
  