anchor.diff:               Module =:= chef_wm_sandboxes ->
       case wrq:method(Req) of
           'GET' ->
  -            authorized;
  +            chef_wm_authz:all_but_validators(Requestor);
           'POST' -> %% create
               chef_wm_authz:allow_admin(Requestor);
           _Else ->
  
positive.code:                              resource_state = #client_state{client_data = Client}}) ->
      case wrq:method(Req) of
          'POST' -> %% create
              NotCreatingAdmin = ej:get({<<"admin">>}, Client) =/= true,
              IsAdmin = chef_wm_authz:is_admin(Requestor),
              IsValidator = chef_wm_authz:is_validator(Requestor),
              case IsAdmin orelse (IsValidator andalso NotCreatingAdmin) of
                  true -> authorized;
                  false -> forbidden
              end;
  
negative.code:              Module =:= chef_wm_named_data_item ->
      case wrq:method(Req) of
          'GET' ->
              chef_wm_authz:all_but_validators(Requestor);
          'PUT' -> %% update
              chef_wm_authz:allow_admin(Requestor);
          'DELETE' ->
  