anchor.diff:  
           AuthType mod_auth_pubtkt
           TKTAuthFakeBasicAuth on
  -        TKTAuthLoginURL /auth/login
  +        TKTAuthLoginURL <%= @cauth['signin_url'] %>
           TKTAuthDebug 1
           require valid-user
       </LocationMatch>
  
positive.code:         RequestHeader unset X-Forwarded-User
          <If "%{HTTP_COOKIE} =~ /auth_pubtkt=.*/">
              AuthType mod_auth_pubtkt
              TKTAuthLoginURL /auth/login
              TKTAuthFakeBasicAuth on
              TKTAuthDebug 1
              AuthName "Grafana"
  
negative.code:     RewriteEngine On
      RewriteRule ^/$ /dashboard [R]
  
      <LocationMatch "dashboard">
          Header set Cache-Control "no-cache, must-revalidate"
          AuthType mod_auth_pubtkt
          TKTAuthFakeBasicAuth on
          TKTAuthLoginURL <%= @cauth['signin_url'] %>
  