anchor.diff:  port_string(Port) ->
       [$:|erlang:integer_to_list(Port)].
   
  +%% Tells whether this user is the superuser.
  +is_superuser(UserName) ->
  +    case application:get_env(chef_rest, superusers) of
  +        {ok,Superusers} -> lists:member(UserName, Superusers);
  +        undefined -> false
  +    end.
  +
  +%% Get the username from the request (and tell whether it is a superuser)
  +get_user(Req, #base_state{superuser_bypasses_checks = SuperuserBypassesChecks}) ->
  +    UserName = list_to_binary(wrq:get_req_header("x-ops-userid", Req)),
  +    BypassesChecks = SuperuserBypassesChecks andalso is_superuser(UserName),
  +    {UserName, BypassesChecks}.
  
positive.code:                     {true, Req2, State2}
              end;
          {false, ReqOther, StateOther} ->
              {"X-Ops-Sign version=\"1.0\"", ReqOther, StateOther}
      end.
  
  
  
  %%%
  %%% Clients are inherently a member of the org, but users are not.
  
negative.code: authorized_by_org_membership_check(Req, #base_state{requester_type=client}=State) ->
      {true, Req, State};
  authorized_by_org_membership_check(Req, State = #base_state{organization_name = OrgName,
                                                              chef_db_context = DbContext}) ->
      {UserName, BypassesChecks} = get_user(Req, State),
      case BypassesChecks of
          true -> {true, Req, State};
          _ ->
              case chef_db:is_user_in_org(DbContext, UserName, OrgName) of
                  true ->
                      {true, Req, State};
                  false ->
                      Msg = forbidden_message(not_member_of_org, UserName, OrgName),
                      {false, wrq:set_resp_body(ejson:encode(Msg), Req),
                       State#base_state{log_msg = user_not_in_org}};
                  Error ->
                      Msg = forbidden_message(unverified_org_membership, UserName, OrgName),
                      {false, wrq:set_resp_body(ejson:encode(Msg), Req),
                       State#base_state{log_msg = {user_not_in_org_error, Error}}}
              end
      end.
  
  forbidden_message(not_member_of_org, User, Org) ->
  