anchor.diff:  
   #### Use Cases ####
   
  -1. Authenticate
  +1. Authenticate:
   
           GET /login
   
  -    The sample app presents a form login interface for the backend UAA, and also an OpenID widget so the user can authenticate using Google credentials or others.
  -
  -2. Approve OAuth2 token grant
  +    The sample app presents a form login interface for the backend UAA, and an OpenID widget where a user can authenticate using Google credentials or others.
  +
  +2. Approve OAuth2 token grant:
   
           GET /oauth/authorize?client_id=app&response_type=code...
   
  -    Standard OAuth2 Authorization Endpoint. The UAA handles client credentials and all other features in the back end, and the login application is used to render the UI (see `access_confirmation.jsp`).
  -
  -3. Obtain access token
  +    Standard OAuth2 Authorization Endpoint. The UAA handles client credentials and all other features in the back end, and the login application is used to render the UI.
  +
  +3. Obtain access token:
   
           POST /oauth/token
       Standard OAuth2 Authorization Endpoint passed through to the UAA.
  
positive.code:     </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.admin</code></td>
        <td>This scope translates into clients.admin after zone switch is complete. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>  
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.read</code></td>
        <td>This scope translates into clients.read after zone switch is complete. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.write</code></td>
        <td>This scope translates into clients.write after zone switch is complete. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.scim.read</code></td>
        <td>This scope translates into scim.read after zone switch is complete. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.scim.create</code></td>
        <td>This scope translates into scim.create after zone switch is complete. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.clients.scim.write</code></td>
        <td>This scope translates into scim.write after zone switch is complete. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.idps.read</code></td>
        <td>This scope translates into idps.read after zone switch is complete. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
    </tr> 
  </table>
  
negative.code:     </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.admin</code></td>
        <td>This scope permits operations in a designated zone, such as creating identity providers or clients in another zone, by authenticating against the default zone. This scope is used with the <code>X-Identity-Zone-Id header</code>.</td>
      </tr>
      <tr>
        <td nowrap><code>zones.ZONE-ID.read</code></td>
  