anchor.diff:  *   The original URL in the content is parsed.
   *   An HMAC signature of the url is generated.
   *   The url and hmac are encoded.
  -*   The encoded url and hmac are placed into the expected format, creating the signed url.
  +*   The encoded url and hmac are placed into the expected format,
  +    creating the signed url.
   *   The signed url replaces the original image URL.
   *   The web app returns the content to the client.
   *   The client requets the signed url from Go-Camo.
  -*   Go-Camo validates the HMAC, decodes the URL, then requests the content from the origin server and streams it to the client.
  +*   Go-Camo validates the HMAC, decodes the URL,
  +    then requests the content from the origin server and streams it to the client.
   
   [source,text]
   ----
  
positive.code: [NOTE]
  ====
  It is always preferable to do filtering at the point of url generation and signing.
  The `filter-ruleset` functionality (both allow and deny) is supplied predominantly as a fallback safety measure for cases where you have previously generated a url and you need a quick temporary fix, or for cases where rolling keys takes a while and/or is difficult.
  ====
  --
  
  * `--max-size`
  +
  --
  The `--max-size` value is defined in KB. Set to `0` to disable size restriction.
  The default is `0`.
  --
  
  * `--metrics`
  +
  --
  If the metrics flag is provided, then the service will expose a Prometheus `/metrics` endpoint.
  --
  
  * `-k`, `--key`
  +
  --
  If the HMAC key is provided on the command line, it will override (if present), an HMAC key set in the environment var.
  --
  
  * `-H, --header`
  
negative.code: 
  === url-tool
  
  The `url-tool` utility provides a simple way to generate signed URLs
  from the command line.
  
  [source,text]
  ----
  