anchor.diff:              + code: 201 (number)
           + data (`Plugin_CORS__Response`)
   
  +## Authentication [/apis/{api_id}/plugins/auth]
  +
  +**This plugin is in development.**
  +
  +This plugin authenticates API consumers by using a configured strategy.
  +
  +Right now it supports two strategies:
  +
  +- `jwt` - uses JSON Web Token to resolve consumer ID and scope.
  +- `oauth` - uses token from `Authorization: Bearer <token>` header and subsequent request to resolve consumer ID and scope via third-party provider.
  +
  +### JWT Strategy
  +
  +Decodes JWT tokens received from API Consumer and validates it signature by a configured secret key.
  +If token is invalid, appropriate error response will be send back to api consumer.
  +
  +It requests `consumer_id` to be present in token itself, but Consumer `scope` can be resolved by:
  +
  +1. Adding `scope` field in JWT token.
  +2. Subsequent request to a third-party provider.
  +
  +**Warning!** JWT signature should be Base64 encoded. Some providers (for example, Auth0) already encode it for you.
  +
  +#### Consumer Usage
  +
  +Consumer should send `Authorization: Bearer <jwt_token>` header with his requests.
  +
  +#### Subsequent requests
  +
  +You can configure this strategy to resolve consumer scope by a subsequent request to a 
  +third-party provider, in this case GET request will be send to `url_template` 
  +with substituted `{consumer_id}`. Annon will expect `HTTP 200` response in following format:
  +
  +```
  +{
  +  "data": {
  +    "scope": "originator_loans:upload"
  +  }
  +}
  +```
  +
  +If any other response is sent, Consumer will have no scopes but `X-Consumer-ID` header will be sent to upstream.
  +
  +#### Auth0 Support
  +
  +**Configuration**
  +
  +To configure Annon copy-paste your `Client Secret` from `Clients` -> `Settings` to plugins `signature` configuration.
  +
  +**Issuing a Token**
  +
  +To receive an valid JWT with scopes token you must:
  +1. Set `app_metadata` for all your users, it should have AT LEAST one array with consumer ID:
  +    ``` 
  +    {
  +      "consumer_id": "my_consumer_id"
  +    }
  +    ```
  +    
  +2. (Optional) If you prefer to receive scopes from Auth0 `app_metadata` should also have scopes array:
  +    ```
  +    {
  +      "consumer_id": "my_consumer_id",
  +      "consumer_scope": "email:read email:send"
  +    }
  +    ```
  +
  +    You can set default scopes in `Client` -> `Settings` -> `Advanced` -> `App Metadata`.
  +    
  +3. When authorizing consumers set correct scope to receive JWT token with `app_metadata`: `scope=openid app_metadata`.
  +4. Whenever you make requests to Annon, use `id_token` from Auth0 response (it's a JWT token that we need) in a `Authorization: Bearer <id_token>` header.
  +
  +### oAuth Strategy
  +
  +Recieves `access_token` from a `Authorization: Bearer <access_token>` header 
  +and sends a subsequent request to resolve Consumer ID and scopes via third-party provider (eg. [Mithril](http://docs.mithril1.apiary.io/#)). 
  +
  +#### Consumer Usage
  +
  +Consumer should send `Authorization: Bearer <access_token>` header with his requests.
  +
  +#### Subsequent requests
  +
  +GET request will be send to `url_template` with substituted `{access_token}`. 
  +Annon will expect `HTTP 200` response in following formats:
  +
  +```
  +{
  +  "data": {
  +    "user_id": "user-dsljsdflkdflj",
  +    "details": {
  +        "scope": "originator_loans:upload"
  +    }
  +  }
  +}
  +```
  +`user_id` will be mapped to Consumer ID.
  +
  +**OR**
  +
  +```
  +{
  +  "data": {
  +    "consumer_id": "user-dsljsdflkdflj",
  +    "consumer_scope": "originator_loans:upload"
  +  }
  +}
  +```
  +
  +If any other response is sent, Consumer will not be autheticated.
  +
  +### Bind or Update Authentication Plugin [PUT]
  +
  ++ Parameters
  +    + api_id: 1 (string, required) - API ID.
  +
  ++ Request (application/json)
  +    + Attributes
  +        + scopes (`Plugin_Auth__Request`)
  +
  ++ Response 200 (application/json)
  +    + Attributes (Response_OK)
  +        + data (`Plugin_Auth__Response`)
  +
  ++ Response 201 (application/json)
  +    + Attributes (Response_OK)
  +        + meta (Response__Meta)
  +            + code: 201 (number)
  +        + data (`Plugin_Auth__Response`)
  +
  +
   ## Rate Limit [/apis/{api_id}/plugins/rate_limit]
   
   This plugin allows you to rate limit requests from API Consumers based on `X-Consumer-ID` header returned from authorization plugins.
  
positive.code: You can set `strip_api_path` setting if you want to exclude API-related prefix from upstream request.
  
  Request Path | Proxy Path | API Path | `strip_api_path` | Upstream Request
  ------ | -------- | ------ | ------- | --------
  `/`    | `/proxy` | `/api` | `false` | `/proxy/api/`
  `/foo` | `/proxy` | `/api` | `false` | `/proxy/api/foo`
  `/`    | `/` | `/api` | `false` | `/api/`
  `/foo` | `/` | `/api` | `false` | `/api/foo`
  `/`    | `/proxy` | `/api` | `true` | `/proxy/`
  `/foo` | `/proxy` | `/api` | `true` | `/proxy/foo`
  `/`    | `/` | `/api` | `true` | `/`
  `/foo` | `/` | `/api` | `true` | `/foo`
  
  
  ### Bind or Update Proxy Plugin [PUT]
  
  
negative.code: + blacklist (array[string], fixed-type, optional) - Blacklist of User Agents or patterns.
      + `Google*` (string)
      + `MyBot (version 1.0)` (string)
  
  ## Authentication Plugin
  ### `Plugin_Auth__Request`
  + name: scopes (string, required)
  + is_enabled: true (boolean)
  + One of
      + settings (Plugin_Auth__Settings_oAuth, fixed-type)
      + settings (Plugin_Auth__Settings_JWT, fixed-type)
      + settings (Plugin_Auth__Settings_JWTs, fixed-type)
  
  ### `Plugin_Auth__Response`
  + Include Plugin_Auth__Request
  + created_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  + updated_at: `2017-04-20T19:14:13Z` (string, required) - ISO 8601 date and time in UTC timezone.
  
  ### `Plugin_Auth__Settings_oAuth`
  + strategy: oauth (string, required)
  + `url_template`: `http://ec2-52-58-60-8.eu-central-1.compute.amazonaws.com:8081/0/api.svc/party/{party_id}/scopes` (string, required) - Inside `url_template` you can use `{party_id}` to substitle consumer ID in a request path.
  
  ### `Plugin_Auth__Settings_JWT`
  + strategy: jwt (string, required)
  + `third_party_resolver`: false (string, required) - Do not resolve scopes with subsequence request.
  
  ### `Plugin_Auth__Settings_JWTs`
  + strategy: jwt (string, required)
  + `third_party_resolver`: true (boolean, required) - Resolve scopes with subsequent request. 
  + `url_template`: `http://ec2-52-58-60-8.eu-central-1.compute.amazonaws.com:8081/0/api.svc/party/{party_id}/scopes` (string, optional) - Inside `url_template` you can use `{party_id}` to substitle consumer ID in a request path.
  
  ## Rate Limit Plugin
  ### `Plugin_Rate_Limit__Request`
  