anchor.diff:                                auth_failure | forbidden | {allowed, mochiweb_request()}.
   verify_rest_auth(Req, Permission) ->
       Auth = extract_auth(Req),
  +    RV = case ns_node_disco:couchdb_node() == node() of
  +             false ->
  +                 verify_rest_auth_on_ns_server(Auth, Permission);
  +             true ->
  +                 rpc:call(ns_node_disco:ns_server_node(), ?MODULE, verify_rest_auth_on_ns_server,
  +                          [Auth, Permission])
  +         end,
  +    case RV of
  +        {allowed, Identity, Token} ->
  +            {allowed, store_user_info(Req, Identity, Token)};
  +        Other ->
  +            Other
  +    end.
  +
  +verify_rest_auth_on_ns_server(Auth, Permission) ->
       case authenticate(Auth) of
           false ->
               auth_failure;
  
positive.code:          verify_local_token/1]).
  
  %% rpc from ns_couchdb node
  -export([authenticate/1,
           saslauthd_authenticate/2]).
  
  %% External API
  
  
negative.code:                           false | {ok, rbac_identity()} | {error, term()}.
  authenticate(undefined) ->
      {ok, {"", anonymous}};
  authenticate({token, Token}) ->
      case menelaus_ui_auth:check(Token) of
          false ->
              %% this is needed so UI can get /pools on unprovisioned
              %% system with leftover cookie
              case ns_config_auth:is_system_provisioned() of
                  false ->
                      {ok, {"", wrong_token}};
                  true ->
                      false
              end;
          Other ->
              Other
      end;
  authenticate({Username, Password}) ->
      case ns_config_auth:authenticate(Username, Password) of
  