anchor.diff:  ----
   curl -v \
   -u "superadmin:superadmin123"  \
  --H "X-Killbill-ApiKey: bob" \
  --H 'X-Killbill-ApiSecret: lazar' \
   -H "X-Killbill-CreatedBy: stephane" \
   -H "Content-Type: application/json" \
   -X POST \
  
positive.code: 
  Each request to Kill Bill requires authentication. The authentication phase verifies that the user exists in the system and that its credentials are correct. Once the credentials have been validated, the roles associated to the user are then extracted, and then the set of permissions associated to each role are also retrieved. The credentials are passed in the request using http basic authentication mechanism. Kill Bill relies on http://shiro.apache.org/[shiro] for the backend implementation.
  
  In addition to specifying credentials, a user must also specify the tenant for which the request is targeted. Those come in the form of 2 http headers:
  
  * X-Killbill-ApiKey (referred to as `api_key`)
  * X-Killbill-ApiSecret (referred to as `api_secret`)
  
  Note that the authentication/authorization is orthogonal to the tenant access: The set of permissions associated to a given user is the same for all tenants (for which he has the keys). So, a potential superuser with all the permissions and with access to the `api_key`/`api_secret` for all tenants would have full control of the entire system. It is common practise to create a cross-tenant admin with the ability to only manage tenants and nothing else, and then have one superadmin per tenant,...
  
  
negative.code: ----
  curl -v \
  -u 'superadmin:superadmin123' \
  -H "X-Killbill-CreatedBy: stephane" \
  -H "Content-Type: application/json" \
  -X POST \
  