anchor.diff:  require both a password and Yubikey to allow access.  This can be
   achieved by a PAM configuration like this:
   
  -```
  -   auth requisite pam_yubico.so id=42
  -   auth required pam_unix.so use_first_pass
  -```
  +---
  +auth requisite pam_yubico.so id=42
  +auth required pam_unix.so use_first_pass
  +---
   
   The first line makes pam_yubico check the OTP.  Use either a per-user
  -file called ~/.yubico/authorized_yubikeys, or a system wide file called
  -/etc/yubikey_mappings to specify which Yubikeys that can be used to log
  -in as specific users. See the https://github.com/Yubico/yubico-pam/wiki/ReadMe for more details about this.
  +file called `~/.yubico/authorized_yubikeys`, or a system wide file called
  +`/etc/yubikey_mappings` to specify which Yubikeys that can be used to log
  +in as specific users. See https://developers.yubico.com/yubico-pam[the README]
  +for more information.
   
   The "use_first_pass" on the next line says that the password the pam_unix
   module should check should be received from the earlier PAM modules
  
positive.code: password first and then (without pressing enter) push the button on your
  Yubikey.
  
  If it doesn't work, enable debugging (see https://github.com/Yubico/yubico-pam/wiki/ReadMe) and try again.
  
negative.code: 
  Of course, if you use username/password verification from a SQL
  database or LDAP, you need to change the second line above.  But the
  module you use needs to support 'use_first_pass' for this to work.
  Most modules support this.
  
  Be sure to comment out any other 'auth' lines in your PAM configuration,
  