anchor.diff:      </pre>
   
   1. In the output from `uaac contexts`, search in the `scope` section of the
  -`client_id: admin` user for **scim.read**. The value **scim.read** represents
  -sufficient permissions to query the UAA server for user information.
  +`client_id: admin` user for **scim.read**.
  +The value **scim.read** represents sufficient permissions to query the UAA
  +server for user information.
   
   1. If the admin user lacks permissions to query the UAA server for user
   information:
       * Use `uaac client update admin --authorities EXISTING-PERMISSIONS
  -	scim.read` to add the necessary permissions to the admin user account on the
  -	UAA server.
  +	scim.read` to add the necessary permissions to the admin user account on
  +	the UAA server.
       * Use `uaac token delete` to delete the local token.
       * Use `uaac token client get admin` to obtain an updated access token from
   	the UAA server.
   
       <pre class="terminal">
  -    $ uaac client update admin --authorities "uaa.admin clients.secret scim.read"
  -    </pre>
  +    $ uaac contexts
  +
  +    [1]*[admin]
  +      client_id: admin
  +      . . .
  +      scope: uaa.admin clients.secret
  +	  . . .
  +
  +    $ uaac client update admin --authorities "uaa.admin clients.secret scim.write"
  +
  +    $ uaac token delete
  +    $ uaac token client get admin
  +    </pre>
  +
  +1. In the output from `uaac contexts`, search in the `scope` section of the
  +`client_id: admin` user for **scim.read**.
   
   1. Use `uaac users` to list your Cloud Foundry instance users.
  -Use the `--attributes emails` or `-a emails` flag to limit the output to email
  -addresses.
  +By default, the `uaac users` command returns information about each user account
  +including GUID, name, permission groups, activity status, and metadata.
  +Use the `--attributes emails` or `-a emails` flag to limit the output of `uaac
  +users` to email addresses.
   
       <pre class="terminal">
       $ uaac users --attributes emails
  
positive.code: 
  1. Use `uaac token client get admin -s ADMIN-CLIENT-SECRET` to authenticate and
  obtain an access token for the admin client from the UAA server.
  <pre class="terminal">
  $ uaac token client get admin -s MyAdminPassword
  </pre>
  
negative.code: 
  Some Cloud Foundry components, like Cloud Controller, only use GUIDs for user identification. You can use the UAA to retrieve the emails of your Cloud Foundry instance users either as a list or for a specific user with that user's GUID.
  
  To retrieve user email addresses:
  
  1. Use `uaac target uaa.YOUR-DOMAIN` to target your UAA server.
  <pre class="terminal">
  $ uaac target uaa.example.com
  </pre>
  
  1. Record the **uaa:admin:client_secret** from your deployment manifest.
  
  1. Use `uaac token client get admin -s ADMIN-CLIENT-SECRET` to authenticate and
  obtain an access token for the admin client from the UAA server.
  UAAC stores the token in `~/.uaac.yml`.
  <pre class="terminal">
  $ uaac token client get admin -s MyAdminPassword
  </pre>
  
  1. Use `uaac contexts` to display the users and applications authorized by the
  UAA server, and the permissions granted to each user and application.
  
      <pre class="terminal">
      $ uaac contexts
  