anchor.diff:  
   .Apache Authentication Using *RequestHeaderIdentityProvider*
   ====
  -This example configures an authentication proxy on the same host as the Master.
  -Having the proxy and Master on the same host is merely a convenience and may
  -not be suitable for your environment. For example, if you were already running
  -a link:../admin_guide/install/deploy_router.html[Router] on the Master port 443
  -would not be available.
  -
  -It’s also important to note that while this reference configuration uses
  -Apache's mod_auth_form it is by no means required and other proxies can easily
  -be used if the following requirements are met:
  -
  -1. Block the X-Remote-User header from client requests to prevent spoofing.
  -2. Enfore client certificate authentication in the
  -RequestHeaderIdentityProvider configuration
  -3. Require the X-Csrf-Token header be set for all authentication request using the challenge flow.
  -4. Only the /oauth/authorize endpoint should be proxied and redirects should not be rewritten to allow the backend server to send the client to the correct location.
  -
  -*Install the prerequisites*
  -
  -`mod_auth_form` is shipped as part of the `mod_session` package that is found
  -in the https://access.redhat.com/solutions/392003[Optional channel]:
  +This example configures an authentication proxy on the same host as the master.
  +Having the proxy and master on the same host is merely a convenience and may not
  +be suitable for your environment. For example, if you were already
  +link:../install_config/install/deploy_router.html[running a router] on the
  +master, port 443 would not be available.
  +
  +It is also important to note that while this reference configuration uses
  +Apache's *mod_auth_form*, it is by no means required and other proxies can
  +easily be used if the following requirements are met:
  +
  +1. Block the `X-Remote-User` header from client requests to prevent spoofing.
  +2. Enforce client certificate authentication in the
  +*RequestHeaderIdentityProvider* configuration.
  +3. Require the `X-Csrf-Token` header be set for all authentication request using
  +the challenge flow.
  +4. Only the _/oauth/authorize_ endpoint should be proxied, and redirects should
  +not be rewritten to allow the backend server to send the client to the correct
  +location.
  +
  +*Installing the Prerequisites*
  +
  +The *mod_auth_form* module is shipped as part of the *mod_session* package that
  +is found in the https://access.redhat.com/solutions/392003[Optional channel]:
   
   ----
   # yum install -y httpd mod_ssl mod_session apr-util-openssl
  
positive.code: RequestHeader unset X-Remote-User
  ----
  
  *Additional mod_auth_form requirements*
  
  A sample login page is available from the
  https://github.com/openshift/openshift-extras/tree/master/misc/form_auth[openshift_extras]
  repository.  This file should be placed in the DocumentRoot (`/var/www/html` by
  default).
  
  *Create users*
  
  At this point, you can create the users in the system Apache is using to store
  accounts information. In this example, file-backed authentication is used:
  
negative.code: # htpasswd -c /etc/openshift/htpasswd <user_name>
  ----
  
  *Configuring the Master*
  
  In the *_/etc/openshift/master/master-config.yaml_* file, all instances of
  `*masterPublicURL*` and `*assetPublicURL*` must match the host name and port for
  