anchor.diff:  
   
   ## JWT Authrozation [/apis/{api_id}/plugins/jwt]
  +
  +**This plugin is deprecated.**
   
   ### General Information
   JWT is a authroization plugin that decodes JWT tokens received from api consumer (with a `signature` field that is set in settings).
  
positive.code: 
  ### `Plugin_Proxy__Settings`
  + upstream (`Plugin_Proxy__Settings_Upstream`, required)
  + `strip_host`: false (boolean, optional) - Keep HTTP HOST host header when proxying request to an upstream.
  + `strip_api_path`: false (boolean, optional) - Strip API part of path when sending request to upstream.
  + `additional_headers` (array[object], optional) - Additional headers that should be sent to upstream.
      + `X-Consumer-Header`: `header_value`
  + `stripped_headers` (array[string], optional) - Headers that should NOT be sent to upstream.
      + `x-Unwanted-Header`
  
  ### `Plugin_Proxy__Settings_Upstream`
  + scheme: https (string) - HTTP request scheme. May be: `http`, `https`, `amqp`, `ws`.
  
negative.code:             + code: 201 (number)
          + data (`Plugin_CORS__Response`)
  
  ## Authentication [/apis/{api_id}/plugins/auth]
  
  **This plugin is in development.**
  
  This plugin authenticates API consumers by using a configured strategy.
  
  Right now it supports two strategies:
  
  - `jwt` - uses JSON Web Token to resolve consumer ID and scope.
  - `oauth` - uses token from `Authorization: Bearer <token>` header and subsequent request to resolve consumer ID and scope via third-party provider.
  
  ### JWT Strategy
  
  Decodes JWT tokens received from API Consumer and validates it signature by a configured secret key.
  If token is invalid, appropriate error response will be send back to api consumer.
  
  It requests `consumer_id` to be present in token itself, but Consumer `scope` can be resolved by:
  
  1. Adding `scope` field in JWT token.
  2. Subsequent request to a third-party provider.
  
  **Warning!** JWT signature should be Base64 encoded. Some providers (for example, Auth0) already encode it for you.
  
  #### Consumer Usage
  
  Consumer should send `Authorization: Bearer <jwt_token>` header with his requests.
  
  #### Subsequent requests
  
  You can configure this strategy to resolve consumer scope by a subsequent request to a 
  third-party provider, in this case GET request will be send to `url_template` 
  with substituted `{consumer_id}`. Annon will expect `HTTP 200` response in following format:
  
  ```
  {
    "data": {
      "scope": "originator_loans:upload"
    }
  }
  ```
  
  If any other response is sent, Consumer will have no scopes but `X-Consumer-ID` header will be sent to upstream.
  
  #### Auth0 Support
  
  **Configuration**
  
  To configure Annon copy-paste your `Client Secret` from `Clients` -> `Settings` to plugins `signature` configuration.
  
  **Issuing a Token**
  
  To receive an valid JWT with scopes token you must:
  1. Set `app_metadata` for all your users, it should have AT LEAST one array with consumer ID:
      ``` 
      {
        "consumer_id": "my_consumer_id"
      }
      ```
      
  2. (Optional) If you prefer to receive scopes from Auth0 `app_metadata` should also have scopes array:
      ```
      {
        "consumer_id": "my_consumer_id",
        "consumer_scope": "email:read email:send"
      }
      ```
  
      You can set default scopes in `Client` -> `Settings` -> `Advanced` -> `App Metadata`.
      
  3. When authorizing consumers set correct scope to receive JWT token with `app_metadata`: `scope=openid app_metadata`.
  4. Whenever you make requests to Annon, use `id_token` from Auth0 response (it's a JWT token that we need) in a `Authorization: Bearer <id_token>` header.
  
  ### oAuth Strategy
  
  Recieves `access_token` from a `Authorization: Bearer <access_token>` header 
  and sends a subsequent request to resolve Consumer ID and scopes via third-party provider (eg. [Mithril](http://docs.mithril1.apiary.io/#)). 
  
  #### Consumer Usage
  
  Consumer should send `Authorization: Bearer <access_token>` header with his requests.
  
  #### Subsequent requests
  
  GET request will be send to `url_template` with substituted `{access_token}`. 
  Annon will expect `HTTP 200` response in following formats:
  
  ```
  {
    "data": {
      "user_id": "user-dsljsdflkdflj",
      "details": {
          "scope": "originator_loans:upload"
      }
    }
  }
  ```
  `user_id` will be mapped to Consumer ID.
  
  **OR**
  
  ```
  {
    "data": {
      "consumer_id": "user-dsljsdflkdflj",
      "consumer_scope": "originator_loans:upload"
    }
  }
  ```
  
  If any other response is sent, Consumer will not be autheticated.
  
  ### Bind or Update Authentication Plugin [PUT]
  
  + Parameters
      + api_id: 1 (string, required) - API ID.
  
  + Request (application/json)
      + Attributes
          + scopes (`Plugin_Auth__Request`)
  
  + Response 200 (application/json)
      + Attributes (Response_OK)
          + data (`Plugin_Auth__Response`)
  
  + Response 201 (application/json)
      + Attributes (Response_OK)
          + meta (Response__Meta)
              + code: 201 (number)
          + data (`Plugin_Auth__Response`)
  
  
  ## Rate Limit [/apis/{api_id}/plugins/rate_limit]
  
  This plugin allows you to rate limit requests from API Consumers based on `X-Consumer-ID` header returned from authorization plugins.
  