anchor.diff:  }
   ----
   
  -All the login method will yield a JSON web token. To make this easy mesh will directly set this token within a cookie.
  -
  -The JWT can be provided in two ways. By default it is passed along with a cookie value. This is useful for embedding binary image nodes directly in HTML, since the browser will automatically handle authentication on the basis of the cookie.
  -Alternatively, the token can be passed along within the `Authorization` header which includes the regular JWT `Bearer <Token>`, where `<Token>` is the token you received from the login/cookie.
  +Both login methods will yield a JSON web token.
  +
  +For further requests, the JWT can be provided in two ways. By default it is passed along with a cookie value. E.g., this is useful for embedding binary image nodes directly in HTML, since the browser will automatically handle authentication on the basis of the cookie.
  +Alternatively, the token can be passed along within the ```Authorization``` header which includes the regular JWT ```Bearer <Token>```, where ```<Token>``` is the token you received from the login/cookie.
   
   [source,bash]
   ----
  
positive.code: keytool -genseckey -keystore keystore.jceks -storetype jceks -storepass secret -keyalg HMacSHA256 -keysize 2048 -alias HS256 -keypass secret
  ----
  
  After creating the keystore, you need to set the keystore password, the path to the keystore file, and the used algorithm in the `mesh.yml` configuration file.
  
  ==== JWT 
  
  In order to be able to store and retrieve content, a Gentics Mesh user needs to authenticate (`username:password`). 
  
  Each way will store a JWT in a cookie which is used to authenticate the user for succeeding requests. The token only lasts a certain amount of time (which can be configured in the `mesh.yml` file), so it might be necessary to refresh the token. The JWT will be automatically renewed with every request on the Gentics Mesh API. 
  
  NOTE: Currently, all data including media assets such as images, videos, and documents are secured and need authentication to be retrieved.
  
  === Login
  
  ==== Basic Authentication Header
  In basic authentication, when a client requests a URL that requires authentication, the server requests the client to authenticate itself by sending a `401-Not Authorized` code. The client, in return, answers with login credentials sent in the `authorization` header:
  
  [source,bash]
  ----
  authorization: Basic {base64_encode(username:password)}
  ----
  
  In Gentics Mesh, a user can be authenticated by invoking a regular `GET` request to the `/api/v1/auth/login` end point including a basic authentication HTTP header.
  
  Example:
  
  
negative.code: 
  == REST API
  
  The link:raml[Gentics Mesh REST API] provides end points enabling you to invoke CRUD operations on just ANY Gentics Mesh element. 
  There are many things you can do with the REST API. To name a few:
  
  * Obviously you can create, update & fetch multilingual content items as well as tag them.
  * But you can also define the schemas, i.e. the content types of your project.
  * You can do file upload and image manipulation.
  * WebRoot Paths for fetching content by path as well as automatic link resolving greatly simplify the integration with any routing framework.
  * Fetching dynamic navigation menus and breadcrumbs based on the content structure will make your editors happy.
  * With Elasticsearch under the hood you can search your content.
  * You can manage your users and their permissions on content elements.
  
  NOTE: All REST API responses are available in JSON, only, except for binary data.
  
  === DEMO
  
  We have set up a Gentics Mesh instance for demo purposes, that you can play with.
  
  *Let's see what's inside...*
  
  
  List all projects: http://getmesh.io/api/v1/projects
  
  Well, it's our demo project.
  
  
  Want to fetch all content items including media? With pretty URLs? Here you go: http://getmesh.io/api/v1/demo/nodes/?resolveLinks=short
  
  OK, let's load a single content item: http://getmesh.io/api/v1/demo/nodes/fc3c85be82584ae2bc85be82588ae2b0
  
  And now forget about UUIDs and do it with its corresponding WebRoot path: http://getmesh.io/api/v1/demo/webroot/automobiles/ford-gt
  
  That's easy. Well, what about an image?
  
  That's the image node: http://getmesh.io/api/v1/demo/nodes/df8beb3922c94ea28beb3922c94ea2f6
  
  And that's the actual image: http://getmesh.io/api/v1/demo/nodes/df8beb3922c94ea28beb3922c94ea2f6/binary/image
  
  Let's do some resizing: http://getmesh.io/api/v1/demo/nodes/df8beb3922c94ea28beb3922c94ea2f6/binary/image?width=400
  
  And now again with a readable WebRoot path: http://getmesh.io/api/v1/demo/webroot/images/ford-gt.jpg?width=400
  
  TIP: The https://chrome.google.com/webstore/detail/postman/fhbjgbiflinjbdggehcddcbncdddomop?hl=en[Postman] chrome extension can be used to build and invoke requests from your browser to Gentics Mesh.
  
  
  == GraphQL
  
  Gentics Mesh is also able to process http://graphql.org/[GraphQL] queries. You can use GraphQL to directly specify what fields should be retrieved and fetch deeply nested data sets.
  Internally, Gentics Mesh will resolve your query and traverse your content graph to fetch only the data you specified.
  
  === Examples
  
  ==== Fetch the current user with username and UUID
  
  include::examples/graphql/tiny-query[]
  
  ==== Retrieve specified fields of a node identified by WebRoot path
  
  include::examples/graphql/field-query[]
  
  === DEMO
  We have integrated the interactive https://github.com/graphql/graphiql[GraphiQL]footnote:[https://github.com/graphql/graphiql[GraphiQL] is owned and developed by Facebook Inc. Usage is subject to the https://github.com/gentics/mesh/blob/d69b94d4b9bd8e3dbbba06dcdf8fac9b09593f13/verticles/graphql/src/main/resources/graphiql/LICENSE[LICENSE AGREEMENT For GraphiQL software].] browser into Gentics Mesh so you can easily play with the API.
  
  Try our link:/api/v1/demo/graphql/browser/[Live Demo].
  
  Alternatively, you can download Gentics Mesh and test the API locally.
  Once authenticated you can access the interactive GraphiQL browser at ```/api/v1/:projectName/graphql/browser/``` .
  
  === Current Limitations
  
  * At the moment, the GraphQL API supports read-only operations. Modifying data with via mutations is currently not supported.
  * GraphQL queries are restricted to a specific project. It is not possible to query data across multiple projects.
  * GraphQL queries are restricted to a specific link:features.html#_content_release[content release]. The scope of the content release can be changed by adding the `?release` query parameter.
  
  
  == HTTP details
  