anchor.diff:  ### Environments
   ###
   
  -path /environments
  -auth any
  -
   <% environments.each do |name| -%>
   path /environments/<%= name -%>/files
   auth yes
   environment <%= name %>
   allow *
   
  -<% end -%><% end -%>
  -# this one is not stricly necessary, but it has the merit
  -# of showing the default policy, which is deny everything else
  +<% end -%>
  +path /environments
  +auth any
  +
  +<% end -%>
  +# deny everything else; this ACL is not strictly necessary, but
  +# illustrates the default policy.
   path /
   auth any
  
positive.code: # (ie exactly as if auth yes was present).
  #
  
  ### Authenticated paths - these apply only when the client
  ### has a valid certificate and is thus authenticated
  
  # allow nodes to retrieve their own catalog
  
negative.code: # This is the default auth.conf file, which implements the default rules
  # used by the puppet master. (That is, the rules below will still apply
  # even if this file is deleted.)
  #
  # The ACLs are evaluated in top-down order. More specific stanzas should
  # be towards the top of the file and more general ones at the bottom;
  # otherwise, the general rules may "steal" requests that should be
  # governed by the specific rules.
  #
  # See http://docs.puppetlabs.com/guides/rest_auth_conf.html for a more complete
  # description of auth.conf's behavior.
  #
  # Supported syntax:
  # Each stanza in auth.conf starts with a path to match, followed
  # by optional modifiers, and finally, a series of allow or deny
  # directives.
  #
  # Example Stanza
  # ---------------------------------
  