From a83d3e1f1ee32a12856ad0316d9556ca7c28370d Mon Sep 17 00:00:00 2001
From: Antonio Berben <antonio@Antonios-MacBook-Pro.local>
Date: Mon, 19 Jul 2021 10:14:16 +0200
Subject: [PATCH 01/28] .

---
 gloo-edge/gloo-edge/README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 69f5c093d6..ab011eb2be 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -47,8 +47,8 @@ Run the commands below to deploy Gloo Edge Enterprise:
 
 ```bash
 kubectl config use-context gloo-edge
-glooctl upgrade --release=v1.7.2
-glooctl install gateway enterprise --version 1.7.2 --license-key $LICENSE_KEY
+glooctl upgrade --release=v1.8.0
+glooctl install gateway enterprise --version 1.8.0 --license-key $LICENSE_KEY
 ```
 
 Gloo Edge can also be deployed using a Helm chart.

From a1505f36ab076fc09b65fddc588766f58c29673b Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Mon, 19 Jul 2021 15:56:47 +0200
Subject: [PATCH 02/28] Put first routing features

---
 gloo-edge/gloo-edge/README.md          | 264 ++++++++++++++++++++++++-
 gloo-edge/gloo-edge/images/httpbin.png | Bin 0 -> 96042 bytes
 2 files changed, 260 insertions(+), 4 deletions(-)
 create mode 100644 gloo-edge/gloo-edge/images/httpbin.png

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index ab011eb2be..1da30b6cb2 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -69,11 +69,11 @@ done
 
 ## Lab 1: Traffic Management
 
-### Routing to a Kubernetes Service 
+### Deploy Demo Services
 
-In this step we will expose a demo service to the outside world using Gloo Edge.
+In this step we will expose two demo services to the outside world using Gloo Edge.
 
-First let's deploy a demo application called bookinfo:
+First let's deploy a demo application called bookinfo in `bookinfo` namespace:
 
 ```bash
 kubectl create ns bookinfo 
@@ -113,7 +113,96 @@ It should return the discovered upstream with an `Accepted` status:
 +---------------------------+------------+----------+----------------------------+
 ```
 
-Now that the Upstream CRD has been created, we need to create a Gloo Edge Virtual Service that routes traffic to it:
+Now, let's deploy the second application, called httpbin in `team1` namespace:
+
+```bash
+kubectl create ns team1
+
+
+kubectl apply -f - <<EOF
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: httpbin
+  namespace: team1
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: httpbin
+  namespace: team1
+  labels:
+    app: httpbin
+spec:
+  ports:
+  - name: http
+    port: 8000
+    targetPort: 80
+  selector:
+    app: httpbin
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: httpbin
+  namespace: team1
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: httpbin
+      version: v1
+  template:
+    metadata:
+      labels:
+        app: httpbin
+        version: v1
+    spec:
+      serviceAccountName: httpbin
+      containers:
+      - image: docker.io/kennethreitz/httpbin
+        imagePullPolicy: IfNotPresent
+        name: httpbin
+        ports:
+        - containerPort: 80
+EOF
+```
+
+The httpbin application is very useful to debug requests and responses. The online version of it can be found [here](http://httpbin.org/).
+
+![Gloo Edge with Httpbin](images/httpbin.png)
+
+To verify that the Upstream was created properly, run the following command: 
+
+```bash
+until glooctl get upstream team1-httpbin-8000 2> /dev/null
+do
+    echo waiting for upstream team1-httpbin-8000 to be discovered
+    sleep 3
+done
+```
+
+It should return the discovered upstream with an `Accepted` status: 
+
+```
++--------------------+------------+----------+------------------------+
+|      UPSTREAM      |    TYPE    |  STATUS  |        DETAILS         |
++--------------------+------------+----------+------------------------+
+| team1-httpbin-8000 | Kubernetes | Accepted | svc name:      httpbin |
+|                    |            |          | svc namespace: team1   |
+|                    |            |          | port:          8000    |
+|                    |            |          |                        |
++--------------------+------------+----------+------------------------+
+```
+
+
+### Routing to a Kubernetes Service 
+
+Now that your two Upstream CR have been created, you need to create the resources to route the traffic to them.
+
+First, you create a Virtual Service. For bookinfo under `/` and for httpbin under `/secured`.
+
+Please, notice that the oder matters.
 
 ```bash
 kubectl apply -f - <<EOF
@@ -127,6 +216,15 @@ spec:
     domains:
       - '*'
     routes:
+      - matchers:
+          - prefix: /secured
+        routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+        options:
+          prefixRewrite: '/'
       - matchers:
           - prefix: /
         routeAction:
@@ -149,6 +247,164 @@ It should return the bookinfo application webpage. Note that the review stars ar
 
 ![Bookinfo Web Interface](images/1.png)
 
+And to access the httpbin application:
+
+```
+/opt/google/chrome/chrome $(glooctl proxy url)/secured/get
+```
+
+It should return the a json object with details regarding the request:
+
+```
+{
+  "args": {},
+  "headers": {
+    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
+    "Accept-Encoding": "gzip, deflate",
+    "Accept-Language": "en-GB,en;q=0.9,es-ES;q=0.8,es;q=0.7,sk-SK;q=0.6,sk;q=0.5,en-US;q=0.4",
+    "Cache-Control": "max-age=0",
+    "Host": "x.x.x.x",
+    "Upgrade-Insecure-Requests": "1",
+    "User-Agent": "xxxx",
+    "X-Envoy-Expected-Rq-Timeout-Ms": "15000",
+    "X-Envoy-Original-Path": "/secured/get"
+  },
+  "origin": "x.x.x.x",
+  "url": "http://x.x.x.x/get"
+}
+```
+
+### Delegation
+
+Gloo Edge provides a feature referred to as delegation. Delegation allows a complete routing configuration to be assembled from separate config objects. The root config object delegates responsibility to other objects, forming a tree of config objects. The tree always has a Virtual Service as its root, which delegates to any number of Route Tables. Route Tables can further delegate to other Route Tables.
+
+Use cases for delegation include:
+
+- Allowing multiple tenants to own add, remove, and update routes without requiring shared access to the root-level Virtual Service
+- Sharing route configuration between Virtual Services
+- Simplifying blue-green routing configurations by swapping the target Route Table for a delegated route.
+- Simplifying very large routing configurations for a single Virtual Service
+- Restricting ownership of routing configuration for a tenant to a subset of the whole Virtual Service.
+
+Let's rewrite our Virtual Service to delegate the routing to a Route Table.
+
+First, the Route Table:
+
+```bash
+kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+EOF
+```
+
+And now, the Virtual Service. Notice that there is a new `delegateAction` pointing to the just created Route Table.
+
+
+```bash
+kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: demo
+  namespace: gloo-system
+spec:
+  virtualHost:
+    domains:
+      - '*'
+    routes:
+      - matchers:
+          - prefix: /secured
+# -------------Delegation by reference------------------
+        delegateAction:
+          ref:
+            name: 'httpbin-routetable'
+            namespace: 'team1'
+# ------------------------------------------------------
+      - matchers:
+          - prefix: /
+        routeAction:
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
+EOF
+```
+
+### Delegation With Label
+
+Another way to delegate is to use labels. This approach frees the direct dependency with strict name references. Let's update our Route Table to add a label which, then, it will be configured by the Virtual Service.
+
+Let's make both changes:
+
+```bash
+kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+# -------------Delegation by reference------------------
+  labels:
+    application-owner: team1
+# ------------------------------------------------------
+spec:
+  routes:
+    - matchers:
+        - prefix: /secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: demo
+  namespace: gloo-system
+spec:
+  virtualHost:
+    domains:
+      - '*'
+    routes:
+      - matchers:
+          - prefix: /secured
+# -------------Delegation by label selector ------------
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
+# ------------------------------------------------------
+      - matchers:
+          - prefix: /
+        routeAction:
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
+EOF
+```
+
 
 ### Routing to Multiple Upstreams
 
diff --git a/gloo-edge/gloo-edge/images/httpbin.png b/gloo-edge/gloo-edge/images/httpbin.png
new file mode 100644
index 0000000000000000000000000000000000000000..8d7b59625c3db26a66856a1cf6a520cb8fcc6838
GIT binary patch
literal 96042
zcmeFZ`9IX}|1T~jNvKqcEG-Bj>&PyZB1`sNvageU7-OPEWvh^7EXls_gc(GUJ=<7@
z8B2C!#yS`?&eQ9CKIgp8=gs$g|A6z0o7>!YJ|A;kkL!BeANTwHy58$(sWF{qKTShJ
z!}R#keO($FIsy&NasE>$flso%a~o)AcxWEqSJ8)9E|1fDUohBjS*8E{ktU7A$C>fr
zrGDlI9?cKlCq898I`{G0MiI{g*+;A=RCE%F*S}pCq@@+4RVP?vyg7erQo--VkgG3f
zMAG=TU-wRG!!owUYfhrvzsG;Jo51%SM&42=z4nrZ_7u-yKhB2HPPar14wu^4l(udU
z8qhY8w|#!xH9K)undaDk{+Li<I6I+cl}J?F^<92{<U`-n91GfTKi5Q_uPJ3a;>|B#
zhSHwc=DPRB=^=#MM`G*H_Z`IW?i=v5fyPsW^w|e4{~6N1!VGpieRcxMtOg;}TogWc
z)U%%7QhrIe!ZV3-(5kq1*!TPAeZ0qL_kLevAlv|bqdO{i<=c$FK%7yBaCd;NjvqO`
z5I*3A*!M(iIrN?3;WGftiU$wySM0GwMP_&D+WSYvMKpg&gB$rk#IBP=za0Ino5Y+G
z+nE}1edt2W)T7A;cLu_AQvC5lXa680AlE1G$AXG2Q5)?-#g0Eh=-4If!}+r>;H6)a
zdb4cQjvVpfOGGpc9E<eNGb#T<@y<8M&%?oS7ctpjLKIQ4+i~IYAqn))m*bJ8#a^1I
zcEcE^KSa&F5R|ZgGW7D;@o!!MTzFLo;T&tk;n@fLGgn4qGcz%oU%Tk^MZx)zIl;wB
z>0;UBT|&ctk@H|ml*IWavP^oW&5=>ZpOP=2!F5&;#%jXKY}?LH5<B8Vvyam=|NMJl
zd_@Do&0paC;mE}1pk)zn?D=@@6`yuW!H0`N{*oJA2zVa??Aw>Cm#yH;9sBS#>1ppb
z;iK}V@i-eq=NL8Vu9rcbFaB1tm5$EG(F&(RLIdtXCgr-z69{+0S=^1omg>Q0^4`JU
znTgQN#Y{_7fErmI=bv3{-;=_Lr!*5DLAYIFyk8#~dmOFD#R;YTKm%dZ3YivF!oY%$
zu-TS>I9ZJIEVlLZjpQR!ME+Fp_fy27LbL3tUm8E#i9$w2UlpL#a1X23Br(2><3|oQ
zy}((-v7jo~kqVpEZetEAke2#Yu2(4QJxXGW(L}|Efy?1X#Y?<%;v2^VVsy)>*m5xZ
zibR2RoT!ynM_h6Epx$ta^{bOi>^Z=+-LJE1B0Kh%-Z*l^n=ic6dWoxW(qrO~Hs@8p
zP<?Oj`zeAOU&B7NuF7@Cq~nY5AfbWq;rzu(Sj>0FBLkYyq<zXn)PyK`Ox+wT-v1o5
z>r@^HgZV5Ed+hA&{915|xFTU{(-OYAefc$sORx9rQR&~vLHF(a1PiyKIj5|5MJQ=D
zknc(S*V!(!p9{Ik3ebmmOm#o7c;#i8CsAroB#+#vi1x>{kMAYR`3bt9UE8Dis|}=E
zU76S=|7<LfTqarvTRO?#KWADUH9N<OFTK0nC~E%wV?D(;-G_OhKif+tj#uMLj^~V^
zhi8z>P*HDwaXouxeS$wXuL%2*NeL-ezJDxem{_kKt3HZ?Mp5)Xu)$52(1lT(deFJ#
z`a}h&Zw#3i86|#2?#LYb=ONS|uR>$w{XOwml-cGY%2qU4uh>#yrVC+&3fPRS)I&)4
zrR;7kTr8vl)!<i)){(m)_V$EGBVjN<PT?!)7<HdoZ77P=vCvl7)GtWwb}6pxjk5~6
zQW(VWe|d@s@RU?Zr_YI!PVCvuN<ND*f`$dpQb)K4U!B9M8H8^g89-EcWAkZZy4e!;
zqy}XF_t^6@7mi8?U^kpRzE|tB<cu!J5xu^&P};B`l+G^Y{MX4V4u6VZ^Ru=4==X#)
z8d<?IqZAW!*Je8M{RoO&EdHJGy-!Vl`T~i)*q2!z$tgFxDrPQq6B%`mTkgnNlozB8
z3JQA4<xJTXU1*OLS{$z{b{@z%H%ZMmDmEmojC*e`R^H;~-(&v2EPAyEJl0LG*H%|o
z9ltm1m1#zBfciF<Km}V_7qlYSMNO{-4bvZ!^IQ2-U{YS;IwBsmyP0ur62-4xp>kB|
zgSeiMXCM|^HMrA}8ur%0`u)i}J30EfedxK?sMJ62S^1xjza=W7A1@re=rDBG8Ht!m
z7obiVDpd6IAmNT1SC1@F6V|7{GZMLdUx1&SB5=<p|0q2YRB+`fZ`0s7LZD6L&;X4W
zFOFPq;Ik!k+t~ACtXOEX#gEHJ*SOk7U{UMWc+zp+^;}MidPBqti5z=%6sS2%JQ?gU
z-Qv7FT#CJO!5ItvW$^6mkqKjYZ9@2%A|pEB7rv3_$PkbZ8aZeKo1owtj?45%?W`|{
zPRTFRq!O_%?sO+Zj@rk8ZIeZ!ksnFQk_#?9dilp5tQQ6XYEk;xog;(C@)7U+6ILDL
zWtOAEVvwId2y4mx*vTWy;Y7qiDF?!8k$Wk2G=9r$eDzOQYikm>j-J?ykh8}WCsEaw
zu$DJRjzcA_2j>JZ_xMbQXQ$)?gDLb;&V+hZS&y}(B1=YHM@Pr-ld*TK@9}D1%5gQ3
z$azK`Ymehs3*WVIIP}e2S<2=ow_lT3*4sT@PayRtI!73Hck5DpmVYkDa9VG<CKwcY
zn%K3+i)clu&K)|YKVy~6>3~Og`23n@3s%!_?5wh?eGUtE7=Z@t+Diwe2Z-Kb#Od7`
zJ#2s=$;##@wxcW{N}d}RERfq#&A&8K6$^Ja0-Kjaa;neFw-36o%RUe3f6*QXeaK{)
zcW&BxMd^jHSrsJ@1z$1xLA#^Bn~)u=WL0#Tq(NUQ`pkZ;XUBHuIOB?&!!z2wAyc%&
z$)IH`-GIX&F+`cRlygGKcM>*zDcO6H5XKyL!z=5IsSJ4Pc<ucttaW#iLh)>2oeUFF
z3-7$xn`sfQHNW>J%(<^DT8~>pF(Gebq3>r7*f$auypvk=VO{s`%0oBx`3h%4(3bWG
zu0xmm!Aq|IbExz+Y_==(eFrgUfz3tIrzJ4EpYW&XO`_EGoXsq9Q%r}++OOJB*$h4=
zXC1}4G|OYmk%y$kS-s%lgXBv0=haG*FU&W3wG5r>K<EM6FxTd#t5*wNg+`8GvYsTE
zn}|DXIO4uLUWl8dWNR2X%@(}TYIg6>D>bcjyv&xZn%aB8xOA3-QabmtAFIf~nrD)3
zDlRci7-Q%i!nvV~>!{w2Mkr_hiz4ybK|%GqP90j5693R<QXyhUFYAoc%+gYR!xlHX
zEOyBvvg}bBGS4XAS+eKl_@NsFkvVwy)Ir=H!m6sOgI^bxYCUH@zz7L?SR<_bUHL_~
z@!g03__8DvGuIy1_a|6EVH707{>u&m=JKp?#*8}+GtLI)6qs;fkB5DK5ja3jlC=3G
zVpX%~&EE4xpolH+%g}h8-^}#1&0sUPyz>W?#g6zdyC(9-I=|REDzpi^n>Q5W(<UY`
zThilL$gk5Y$D{eGcH_xyo}71m`xcA^^llo(MRsxfsJBENGVU*5K4%9eQEi%Uce8qY
zvDYEKIprw>p>E@H&Ny`IR~QkS^p{1+t)E4S@=XCs%60rio40K)5G!DCoqcWjd>k$C
z_65(hQEA~Np;lHCsi{{Bc^l>e33uQvNxx)$W<#WsE=9Nq!LdnbhsU39_6lh(Iqxho
zX_c>QVsv@Ka(p+{cW24MyVO>zB(2sH`xNZT*|_Y-xI>qy{GH(V6TlMf{r<!rjZ9GB
z_Fb1mD*5adm{u*!mJp`p*A>~3%WEG`yp2d%S^EuxR>TP;+t~NdbwsNQBL+&_r{dS{
z+6!&ix=T43>w(<I2Jmv%)Dx~JZ0-5$Xw+|~s>1CJsb=6R!w-MkB&`<%Eo%302q9|@
z=6TAl>iLP1L!<gxuk3w%4{{DW_dCVF%OSEd--_{cU+{4?pRF<fOzk*BAY*lQH=GJR
zxjwn6sHo)imlW!iuiBgx&=zSeyZiq9PTQW<up2g{XJeH=RW8tQH{tmrZb<A8h>7-i
zv`mFW<r>hSx$NIg)28KpoHU#kApk7{<E$-e15IkYW^}r*j{IHXSoN<FLg+QPGx@;E
zBT)Mi4&4iXK26v95mG$o+KZlC=@(K7IdSfDg02t<d{V9wn2Sci;`6><gVIiYKbc$a
z@R|YZE?qS=%B1|K<^pHArE-~V@F$Df%Wyb(i!&iqH0y%SpG^++Xu;UNOpQWdQ}#z<
zRdoI^g?gMgu`Oqw`tf7kD14%%JGtSj+_h_`iKL<OnG}yQ@#M?Ja1jgi&N`dV${r4Y
zc3);b3O+b(*BOHy9U7b^5av9QEB06f5j)nZibLdOhh5U4$o9y+Ce2>%i4{s~qFZkt
zYE@h4%R*xtn4MSW_TP~Bz7q!O6Z*0>Zs?i8=fF^l$cO}zSiR=LVW6pzk?tGoL~9ta
z{zckeqNIC{lvz;k=Zl8h96=J-wwLf`dFU_$^OKoblr7FW$)LX5$%<ax=^a*+BYo`R
zUqc7c@^|7v@Z5Uin(lO%X8K5f>n)>h{$)Hz^?U{++{$|x-nHhh{`qDpwK^zW(PZOI
zM`^66nJx;7Ec)9PT_ayrN33^BuXP^E%C+w_&Dq55&Ff6#ylp!d8}u!TE8VBiuFcg-
z&Ogb~Ns)5IarZp)(xm3OqS3_A>%Tr+s-RteuQ%&V?zRx=NgLLCGm!2gXV;N9Vq>Mv
zp7=6wC$G3-v13z&z=2Rj)eahDqu1NxuO(yLHF<CwvE9r#zlDK=dSeZ%q9QaCr5sB8
zrLZNwpPFCsuAg-nOk_e+yr*Y1wY8elG`B;=t3<~Kkzicyr!u>)oI*LOPW{+Ote~A|
zm)Upoi>boA@csLy8zXUo`aIR{W8X79GgA$-!WSx>@qU83w^BDL8zW(ZnKq0<14@wX
z@64Qc)28{g7JdrM;m%1B(gW{~96JQ~Pn<jV&iN&`XcJVT9JSs5K+<hC<dJAP!)|Lm
zsL{Fw$)JHFKg*MLA3eW7wdRQb6SzHLIa-ScF>&6#)~@2Rtt(&DM7Dl~t+Icmy+0p)
zs`blVy^|4KJ4I3&3VX96NO-3IaZb4)bwtn@yEQIrS-U|od4}*ji!_AW`}!%JUk<M{
zk?fwQ+a`we8>}*!j?*vlX4qU%YQLdm#6tJYySGVFn&nKV4~{%{EUNC#P;+ODUuBJF
zRqPYfx)rmCD@x5yp!JuwT_60ndb&91708h<0zOWy((n%ET4*ZNR(Os6>U_6v6SZEG
z^*C8qlLM{)cEhP)gxY`~&5m_x_>}Moj9uLJ949&J%=zall{@0GN-WMJ?VDSK(5RH6
zYXo0k$gAhL;2WmfBXL?bw{&k6FAnCh$M&Zk&a6a*E9=u9>_=*w?UnGtghWuT0}lVM
za<8Xf_enUO6Xf*85WeFRLn7Tof+mZy%ZoKJys1xo1Y4&?kWuX~J7NXW&Z!2-;m`LI
z6$R%UnB7N3E$`fIvGb;m`sskZ@oX1qp_mk~j}D$K`M9G|w>=USfGoOpqoq#%i$I$M
zeCxzgosdy+E`<Y@WIwCs^Kqq#e1P%V*j8|79)Ffm27&3!?4p~%S%IH(ec%gggE`Et
zX|U*%QU$fUu7_^3@<p^M2N2JF<)vL%mXKzmKDruv75I`TR|ZOB*`;!3O3Ykeld@Ee
z!nRr@kx`2~30o2DXv1vg;`<IpF5G$=`(5so%^|94@5=PF$@J!Z>DKd#y&fW_+mB%~
zzVD<W?{bUwhCHy6i4Xv%B#HAz((bW3O|zJ7Zh{czk#+9LZ2Eh-_X6@9RT9=Di>d&i
z)K|)yoesl_jfg?3I-Lg#+@I7wJDg(RVmPJ^%n2KIsF?IEr87>$-dab318boy=jq5D
zD{L`V`{&xVYr7unzT<Ul&Vyg}?Z^ZzkTSwBqVSDIv-_34Y`q_}{yq~EPm|?+M)Me`
zKTgc`-Lh91Hxy=<-888k=x1i^s})4pU<52iB?D?yGy&x7sNiZ`=3UuwWk*0a<4@TG
zJpkIcC|TO3mF4nV)jT&zc%bHo$IeM#Ei&A^i^5<^v!JeTN!qg=h3&EJCShl|?*`mk
zXA|+-QSD5YsI%AP=EQU7ns7`~O8d=M!0LBm17@9e_|-FD^elC-^ly;TCU!EFCRFjd
zm#<Hw`o(rforV>(k(=zsK(7ryXJW!qjqQ({p`RZ#KZNCgLGHeb?wfO7$=KRcxOo7s
zC$6`7E*)!mHP(5rvbeGUJlNr&df0Z(qj>86rHR&jBDQKf7vDrrkE^mb=9cyBT(Ep0
zr8+LT>)4%*{#HE+GAi$GuCDQz&T<}v4?0<y`6vH&f8;lbV%X=8<ebtGoF#smUhIQ?
z?Vy3rH>Maq=Ehulnq!VKeXzNR?X~`)??r9-F<2GY_9XL3LKD@%^$jUYF$h;J*Vfb1
zgC#{F;Jq)eaeu$sTD^2hZooLI6TO8JV9=`z;)rvfJ=T$5Ea^G#huOjnWaDndjU&!K
zSm@7O{XK&IeLK+{X?zaoMGUiKBm95I2pXKGqod2!YOd016?38WcEpTLdX<-W7W=8m
zR8okqeh8XoC}&*A3heH?xWsMz5*$K)xM}&-Tr0!q?a9NIN)+ONgF-S8G}}I|Bqulb
zY;s6D4a5s*4UJhq!Dk3vu6`0r3VYHX?dHN(Gv>`>uTgv(m2T(WkQnDQV@#H%m+dbJ
zyA3Zh#f4>QCEOVcz%*9<GK4gE_j+eis>44Of>|p-PCHp0?8Kr`=vp(CJjE;JOs&<^
z(?bN!l#QTi3n!~537UN%9A$oE2T@#&?$~q*`0E<ZAH{7?w^=0ZH|;z)WmoAm_}iLo
zUAm3K0_(HbGI;&R%9GABd&LdpyWJY|@w#^h1>@{mQ2Zc%x5KbEm&P%_e|^n6ra8|P
zv%~848?Ako_agh}>|1IQ7C3{}TZoE#u6~$!IIhwNyjg1{s<3SMKOqw329OE~y-I$w
z#&Jrg{5FR)-?Qm0{;K-*5CT>oM1sb4*b{6vxaA)zQIO+K;i;Vz9RSCLuSNL}tuzc2
z&hcbZuIHsU_+Y?`a*h65un0E6T<spvbsuRaz6j2|rZ?+#oCJWn*tm!PqJ@hSFfdPl
zyXmnV_$#k?V>0HhmRl&xO6HoK#>2LsolUqp!bbppW#<otJeTLdb(VoLlYt8SHDt$2
z0;8yI^s431dCq^CPoso=P0CkFEo^L5&URUH7aLU*K>8V7pY2TWa;7>DJvwgXHwn9+
zR#R6?oa|r%z8xV?G8~`LqM0~Twi4*w4E38EM7hWf78-QT;NG(GYv&ta$UY0r?z~}a
zgYi!(%iJ|y(n}Wut6n%~!2QNzHFt6CJEu<(s|mR3{abF78BjJ=F<HsviiD1yqOK$R
zp{xe+?1?7&?NvUcAKQyMA+@!f*ChKNeHT-^y#0mf=*D%D-|lynR7;&!O2=B{>^<LX
zUmS0)c^$ss&{4%1;P7(&TS)}_z-I=c+rbVG_J%x&;6VHON3N(Je*i-IkshivC|Ya;
z#yVI;PL5Xc48lfgZt4Numy}mK^wV3Cy)-i6BKJtui&f9A#Jb_!1OdH)GLz#%jr)_W
zZXz1I3BQ7}HQBF>T-)Y41fCoSE#H)fX_PEqlg`nNMFl{>&ZWgBVxsD4W!aM`0k}>3
z#P`uBx$Jsne0%7Mrxrf0LrqkVgHp5+E}$~)4AlW9U~{V29F-LiF?yFtH1OHV%C*PI
zqk{wKVe8aMIpn1a8AEan`TY*v4|aN5UyHrk(C-a-ijCqtEbY%KPy9GN{7->L{8H{}
z$}g%?Q$T{|D%=NYcgXynvI>4P<{#LE3Q7qqCDndxf@~r&R?#g?J_}U=T_+<D+n@UV
zvcA;k=7KTLZy=*?$wc9aSPRs)JGee8z$d@1LdJJ5!_p1czfhMKn`*FMZ*kpcOA-m<
zOmLBXF>lPN;M+IdaQPfcYQlqG@-Q|+nI@Q??-@W%k;CE!a%#Ms;?*);BWuiNVUk)S
zslTVZr(LQ3b-Ok3oK~5-cN3Jys%jVsT^x*7w^KyQe>-k>SrqO7a1IT$52YaZKoeP0
z$$jvv^>k7<=-W$5Xlj*7aKLt<W`2wF;5X}xZlGHwjMrsHDVgL&DecJjDP72V{d78R
z>6Tlf{->(UV~0~?kT{x2*zGr@lo;OsDiI6Jx3=`JMQ|(J>62?756LVvMHWaGvfsrk
z+5SA?Hn!nap=wt?O;6Y~dY>I8v*EEmD?C^*G&%#x)@IM#+wmM}fC9mm&xz!i<adko
z2=6tOR6WcJ{3vkaLeLVfIzP`)1iUYkW#{!oZJNIaoj16|$!v!{@f}JkI!}M%mg-yY
z_K%8%m3Q1e-+X@qmF;+h?u8XlhH(D^*p@jf=fzGsEu(S(nGB%H*S}?2b0nJd8#qh)
z`11qnHLovIlXcQ!N(2e=A+$zv@#xu%S5c5Y*;vl)`VJ~z6nEA=y7dR_f{2s$y@RCC
zhIIX0U1K~zV@TQWohdYH=(WS;E2b9O1_y5ukOD|tC0W#MkLp1AzQcA=Fy1Iu=!;&B
zI4=MyreBCy1e_UIQ6MLE7u!d)FZNcV0t2Zo`}meFcIidcxJ&=yIK&?=E-!RKjacCA
zF@i-;n|C2|R%{RdjU_y}9{TRTya4}BR`g!tK}J1?5Q^@9sG%LqQ_MEMoAO5~u6X`W
zTDrLPQpMvNoFZEJRp5o6Z4z2+x6RN`0;<df4#>k-p;1oz!K%(=XFY?!qHt7U9TAIe
zjM){VT$KwlwSt$o&1hPOP-8pn<xZei>|bMK@634R>EF(e5r}qK5^ZoMq|%#jQFQTa
z8-{GH^p~;cv2|vcX8>RbC<+t^UEjg&MzAaRCU$s9vOH2((CbW`sV6jEa~rGpWhbXc
z!VT=R)cx|Fr4%Vq^{cDt<v5FNSHFpeoz2!njHdm3Iz<DwYy13oq|83cTdQLKe%ayD
z9gEsaqT+{1%H)mK!L3b8E(>AS7+?$PNh{3Fc3;ecmZ2zyYJ&l#A5c!VfO-I{HHAo(
z5wX!hnh5RLpq$$Y`v@m@#q}>lYI#q?fFv9EN&E!%#I`kP{q0W-EYxKVT&JMm6Y4u#
z3&4Dnw$BvO$q=Wr0QQ%WF_v1a`hbpaj}vxMIMbeR!>nS<f&Wkr_AI1?77%;^d@-}I
z*?r0lS0mIXG$V-Iw;@?Aj(X{2kP}aqa$*rCJLTC?pHfp(n^$daAd4x_FK!0rr}z8&
zYXFs(GvTw^WOZkPxZ@=9y;f?f99)G{j?^D3WF%i}Xw9*?)c>Hz$RF+05dW5x)hudQ
z)Sr>-l`hYRVP1ELs<xjhKa8E_dHK?h@hn#D22$w-F-I18#Xs4@XcAS!`L+S{7#B#g
z$?$v2KM7lX{w9`B)4AHt)0JNA2W7kWRSch|VAMT3iLG2#HAkR9_nw&ebgFeUM@9Hx
zlTW*ZbfX6|5aNWb@&)>pd}X5mG@b`+Od>smRE;<(+iggK=}wAkmUovN3aej_+!r3^
z@I8ne<c=M93x*GDzb}`+64@bL<7Gdj){iv`Il=I4oL=twp-W$Rj8Pt-c*Bh97B>>S
zm_7Nvrzk-~G`av8I43BYSqoQ#c<k;1S==zujF-gV&jd=OV>;`7FP=e^-F6v*W#>xF
zcAO|Hk}f~H;8Mt8#@I3{ZDi-wNs`D$X3ylKop#!NM3xq+-A8nomWI5IA4xBZiSEIk
zW)Vuv%3DNpRWY;TnWkAm8}I9J6@yNfY8gT}q;qoFtaAQtX;D_lUF@=b{whO1D0OlJ
z>mbhinT7b5EiV90I4N>}VXy6gm7sW)Q<YPx=~pj(lVUs(#VzqCcR+i%dj*TiPYuEr
z4Z28wN1?NrgGR)82Y^D#tNwS}P}R137HYJ)+MN1PU`X=WZ+b0~uQ&Dn?H${^zU(lF
z$KUyl4#mUJ(J7v@P+EYI=Y~qAY}z*AZCbS#fF{`R1>(BDXQq0BIiT@IR2*lWvf7&~
z>rT3R0KN*?7X&`j3##sV0|>`&6lVb8u3y#wNG{I10p@<Hs)Zi5ogXc!)c4mp!}ysx
zzZHi@UDf;i@+TlThjxes^z}5m+Hfr|5ATE?kZ!cvv+w)PY<&I7LxHW9QK@9^H&{l4
zs@n-M*HmRgA3UF)8tYWpGHtcg`hoJ7`=<L#JRs}781yoC07!obJT}nQpS{`O!{Iak
zTP*t;N@<ESR?y_O$XoT)BfhQ%u>49-?C{jC-bBLBPETBBF`U3eAf#MlrZJ4OX<ZwS
zZzNy(#Uv-rx(jmb>s`P{s!(e4b>E1yY~7S$KfF%fe+=wA>gFufVw05SO}MdI>iX(=
zVdITA&67(5MOj=HqYq?mvSNpFFzva(3({khQkQD?SeCBd6*>HYGN;dCmG1eSn55kB
zE`9Eiv(6S&RI{$+HQ#$XQqE)SZ1vJ*^O^unLPSEIFveFl!uDU}n#b+Pk41;WA)YEa
zKo~ZYWF`Y}M%7$&C7`t!K98?&PJS4F{lV$M{B@+~EacvMR{GxselK>~4e-M?8i?xU
z7yb{069<jzj1U2<BjS>W?`d~{F^&2IQ-<uHvM4aVx)^}~4I+I&7B!x{4^fH<qSY<o
zi^YwNH^ml1lMj_ilzCQw@TRdc=t!V$yTnA9tF=a^>Sh;Fk}jogZrtyrtpu1t>#jeC
zce^yl2y8q^64k|)``SN4HuWqgTPt<&8?R7>@3<e=X39;E=P3O-y1{~{4@}B!HypXy
zkJ<uHoy9_1eTa@1%4dV}G~zflvNJTJP2EhTwjAN?3S6{9MRW@jY3b;FAYDJZpQIN`
zJAVt1`PHLkWBW25rw!!l3XoY%W(cYCt1?dAw1;8kV8G-B;qDQU$qxJX`u*<-J3#@4
z6bp~IeC_ZA;d!Yn&kB@#2ezdC2Zs>=2cHpxjx|9E4G+VQ)VO(47yu_vIb-+2;kzji
z9;Bhsh7DW1ZyzmUQTx1Yt}R)WH$`NMV)Ua!ZF^+SD$k>Nl*KjX$B!So&dq#4ha}u&
zV_6^g02qJ0w2&RH;o;{2Ux7_4N2_q|27b2jNBZavhTE_XV8WeyD=ag}e~t*Bi#xbg
z1eq%7Q&j8i%$g}AY5NnBsTHd`6jHRbGG3Rbm!J6IqVVNR#pmU#L=s;v94E3RVpOoJ
z{vhmvPEnG!<KKA!^`x81Y1gjFLRY{Sp?P0TB@4loQa0S6)f=0O)BsmzwaHf2`gItY
zMF=n;v?KUK`#r$8`gAaen!zrrzXo}7P=mrp!Uj-Ym{X*YdYd?DH|)WB_8%iPyF#{q
zdmP}rO6T4?>do)E6*x1G|2e`SfYf?PwCwwMj#V-TXNLa8z`y_yBQ{c=j$qzLA1Bhx
zOG>82j-TSjl2%r00gq5YX#zb<7h<3~#7n!G3?;2RSQxv`NC1IHt^w?_2+s4nukfRe
zFU1A``K3^`A&De?R~2=VvDvyen7e}%cW6JGc@E$<--jLA6Q7d51f-YNB*kKLSwf#x
z@v<x37<6C$tJG5cr{dJqBFmaAK!?+fRi7yc1GlfoD@#A_yJ`3$MG{y==-T%R#<-1X
zL&|smx(sNokC3s2T;<czirgD0k8kI(aLGA614vcH+FZxXQ;3q+)^$7v{>TQ$eRe^{
zm8sKpUpzAf9sEkoduxm?_O_*drDef&)-q93<UM*8&e-DOVuhFkrfsGxTF<J$Jo|=P
zR7YoLHL6XgL|M@wPv;?gnW_QZS{Zt;mpzmE+iIaN({R)IVj+m<NrO#`rcvHN?ge&F
zBLO|Wey<q~A-|$!^v7AzJ#!V6p~8LXR{Wo;8j5+RAHY%!P>+ZDP@5i*jc>@AtSj5J
z^$p7UPQ?Vm&I|JJDC0*ZV;dS8DwnG84FY$ZbltFJ7H})1ZEV>Bx+dZ?-N|<Ouko^8
z!Jlt3|CvnZj}dWWzX%bpUK}d4Rx0qnCFweFpXth<8)a!SFl`98ow)CzW{inXz`nKb
zx3$YUQZ}Co7jYtCDFLW)Awi40cpr}_PNmGwguafR9&Nq}yb>h*?U{Kex(%zM@n>(k
zX4=10j9S)v8UWg5H5GFLZ3QcTY+(s@Q#c_LG*vO%ZS@T(TxtRR_b*`^%=aG%$z#{&
zf(~|d0u#J-u|GP2)IhCQo9niCr+WqAu0Wq_5?w2(m-pJ|sst;pld2u_yJwfwqG=X$
z+e9}`f}r^a70@-L1^jZEI^BaAEY#!J+1{Q97!+XLlL9tlTMQw%a?%|XXo@rQQOc97
zjqdHo<pbGs9L&CHX=&^dL2sMq#-S_*(Qz&{ocVHl0J({-VT9+Kq}Liob2d=Z@N#~+
zHkeCWUVGcone0R@P=4UkVK+4LSDtQZ(&kRhI@`vt4?Y3u%|gs>ofrm{q2i@Cc^9vv
zsFNH3Y)uG1oCtvY1uDxv6G1b1n*#)1_>*R1TDmI)fazC#S&!{3CIG~<IE33Wo?MAc
zhCBZKqloq!3JKYu()Y)Rf<<BlcVeV4V<&p;5kN`j)w=ri$(4PfPi2m6r@NBYEHglw
zwv({7sR!P>ohAV3tVP&Zv{lLiU~&e%UoTJK$W^_Q*^ZO^h3nF0-pynVkh@7a(G3&7
z+FuwzDQchXOx{lbQl=<IKyMgRcbag6BfoAPV3f-Od|kk)PT<i^4oTA+Z#Sw^rvaAC
z7AttFK{J6`nkbp)GR}G+&1N{QCvi!}Q*n!ZhL6wlN3QV#Md2vd9Pu}R??Z(UHbwK=
zO5mYiaFJa1LTA(OkeZe8XrS>f1_aQK*T3ym%*;x_qll56hW%0_1RPs5glYJ8b)?+6
zrQi*qU^M{JrcJ}+CnelL=&F1<$B93s?6M`<6d{Re%<b*OYcN@tAEpvZ<E{K@o0pVH
zMR>f8zs@8jPs&QjDkUjE9L@zT;Y>~-O*TWl6r1Tuo>#Dlwfmck$Y)oErL~*LL>nJc
zm=w#C-OUBp*vV42$!7A;W5>2Y;!RuSP?Dl1qEcB@AEs63yPr9$xj3S+7w-!gJ$sYr
zG}2KeB0&A$_xr+n=yKy}2ev(tCMfF{biSDd&`(y;da~X^bQxA7!*VTB`C<+B6>Q$_
zH~q!S`I<;!Iiw2QVlBj^#?2}n9UE@(nOAppM$M}y5bM>3e9^bP^zyQ`_n)#$RYX-5
z3nM{x(8#L_Y1&F=nSRg)C!e{;ko}?hSG#k47h{FI8csy=n{AIQPaa=Q1_=KhMtI%r
zU#x&-gCTlOrt3ZkAUtxD;uiI*-@X8<N}>6BWv!n(8Qev_vi0D#CO3s1{<Zf8&d1mh
zR69xW!+{OA_{(JFADPtb3h@Fe&q2GVm@*@@pAG0u6;wB@$O|@XRI0q0rd5$mgs@xU
zz?Kw?YgLC)q27x5-Gb_i-^zjVpcVl;6fHt3{<UWGvenbfe*8cW-u|c*<vbLK-36D^
zEY5To#mf8ZQoMHZ+{e#UU3w%1$OXaGZu=HaeHps*<2w0Bt?F*KSSoI0D+?KJA~V?e
z6Qtr3%)g#zA0hY&E5`R*I@9>{h2Ji*tGO2CdF}gVM*Aq1tVMja?C9|+paU}to4+Km
zmvIqWz3@j*Tgl>QQ26Zx@f-kYY{9jYq_yEI<Hb(V4<E`hn;nmvgkjAC#I4-(-}~o?
zLAD|J;gMHVsev_|T+Hzge1LLZ2(T1p5*P&1yw#Kjy=~hWZ`t;lud<y6HJF)fFpZ7r
zTIdJINOdT>d^sZvw7!<G%ufbiZY|q4kxRL|E7b82S;PJ!15CC4WR18p$ytvaWIq<2
z)ved`+P>5jo_rVDUHhd<>P+WU^X$4VFQNF&Szj|i<u)v`ES9e+7YdGw`pnO$U$__>
zE6`8*{CM`*pAr?YoIHeh+3NfxOuxeMP#D-aeN7oc_~CQrbZy#eMTRl75Xjo=ck)?Y
z?Uc@35bJ3x6nn-6fzKvCO0p3QSzWZ>+oE~B65H@j+(n}atMMh{IGhsS`1dgqV8LD^
zk@TKD``S+e(5uOhpbr<?3eREy?$x!sd`5k7w$My{_Br=D`Uk)u;K@JHFTvxdt1e-D
zd=xrw?_>N{zF&>XpGJr=bMB-C_z)ZmJ)RXI1kx)U+tfD+m|p?J5;t-&0Oo=!LV;T6
zChL1B;W_c?B4oJ<s>iLk+7K2p+Z}7c+thgvZd=@EBlE%x!tMKGRBcs~5K3YlNH>ED
z5kdP@YG|Qs&{T|pcpI|jDaw>C)RdBvG?&)gTF|FqFXypV5#YNt(dK@H4K%p*{zNGw
zfjfF>Z8-I<fY^nrff&Kc^&D`kb`tu7ftA3`jUw9fyk+et4RZBGM(sSgd{_>*|IpBi
z0d+d6=9<Ex#Qi@+#MyjcZz*km?C|d}{{N&XewqVq;_Tav|MSy-f248&(D=0q@+TkO
zog8!vXT6R!k>fe~jvv(+(9o6&0_{b9lK0!Ax{H^}od?~Z`y-bBk6`lv?zh0R@5<5d
z`G14*?{oJ*2mAjG%Atb-x!p_#Wb*c*A+=n+%<wON0KeX5vvxyH;K=#4_4P1A?oW8{
zowbXb9P$re?fMw)dOKZrS=pc@l+OXyn$vWEdn(XR_|~Hz)$T%WqXR%ywHrtJci7<=
zSotaxS(uo7c3@LKk9|qK8|f6yqe4r^r}@pcjka*#w|Zn0L7=em>LyC&UU%i5VI_U$
z>{KY*Z#+<!wFLCC-g)Z-wgOo{DmXuRRU=XIz3xrzOAA3!UdPutWPEm$%9K8t1P2Fu
z_~x-pk*+$t%0BF@P%uP@I1G5M9Nl--9fb5LFP1+#S`6!D_vG0j+!OE4z<`G4hAHfR
zRsWj?(L9eZtwbd#5>PL%ns{Xsgp9z?>Gop<V?4IqsZBkb9g#RGr!gI-tFneldlg-F
zH~`wA0a9h0YiPq|7u3p7XV)F0Qd|wr1==*vn&SK|QBY3qu8+(8ovYj}%nsd2{e=@4
zfQLq4nhD#REKFC$4TIjFKQQS#4}AS1>*IQH@&ya0VwNv>!`D%-f*9>QxMmj%sr}t7
zGZ^aIc|%Qm{uP5n1*zxwme^mwu*a<lv#PJJFI6m}Uxh|)s`MX5ODH4R4mNnR66cVG
z`IFPLMKb=21!cC~XC2C0xbH)_&wCCjmQ$y-zc>x8C`oOhj-fTd2zfXGOTj6Vu&M=T
zYwXHTq8qw81J}1g7^dlw{hB>rpbz=H$IIM8XN8Tkq8uWISVxk$W#hLfWM6|f4jLxq
zdDVomOn_HL$A6;em)(C_y#FHtfIV0Gvkd?~wuaLsj_Y`=#2hQ&=S}XUZ296QP3vv#
zUrP|(0AuVrznR2J#7v?O&JkZrsPJ64%^RgwPQ=Zx0fm7+$BNLco-CXB<a^L+YKNd<
z#j~VwZVw7HvOKt7?2uhi8F^6P$k%T0{qAH|g3Tt0+dU~}c0<&mzArV5WPlsUkKxPM
zZ1b8F9e_k1%rdaaAL}#&v!LfcQDVeYWnp`5y1Z+oYW3f)yVi)${2JfhZd&TEW`{ZU
zRrrsVJ2a>(tj8>(gH*JY41UX|jI?&TEBVhR0YtOG`@O(TK-t|iUE(vmwIYbL0^r9N
zSSeao3oyhCX6kXo9jjTu0WF`kcHqih<}RKz?v8tSCwN1GH$^x95)&uVoHN^Un%Q}z
zAjPuCs=p0wLFN-3Dx;r*<K=RkB-rLB(rns4^QK$6j6bqdk1g3f@JwD3wa6453QAuB
zx#yZEObMFbYGCG+b@soi<Y5Z<n9wl{&4uR`?dt${i6vnz@-0(<86a&s!!GrTZ7q)%
z&*azlZ6(8R8MNDe@oB9RE(kpj;M4LVvqVV&gZgEO#o?ki{dc$UO6pk!AN?h)4@?2Q
zN!pdq7u3#uF)n*U(qPjx8kNi~P;`@M;{TVOpd$vIu)gXrO2kLi!uapcbX*$Zz?+R~
zw12O&>N*|^^qfzB@UPE@#qRh23X3Zwm%3yR#Rv|<d13X`S$bj0^9ZeES(kAmfb*>8
zYLCYUaVzBmZr<I%9aF$bs%aqj#efo*hrylkn6u}Szc0O2@=n+ip9e_7X5ic3N3SpC
z`!#$D$TT@#NDfGs4r+M7`+=<&XtYegh~ajX1agi`j|$+m{-Ca;*EvaYjdZ%*1;#i2
zxS<{=9Z~BOq&d^^r6Pz7fXn_Wt02Ahm^Ontdjl!|nn)B5LT<Q_By&jK9h?v>Xd-LG
z73HY(Gbbv*!n>`$f3?2B?=(|pBBJ4ORR*HZiCs=VaH7@A-vyX*j|BA<Da)L{7Yd>f
zk{bC9d!vF+_3|GYxKvd##B2U`x%YcYn+?4dyR@+chHm`&d<DRdac<nKrxIyA2&v@C
z7ptdHyX_s$<7J=v#iS|U4PL#CC~u+w@~+duoQwDJwt#TFgbJVlB)Okq{oK&Mq?x@Y
z#mFW)M1b!((Ir?{51%G<g|80D)))Fg{R}JfdTOp34SOo8MJ4Mam=y}I?6<TPsQt;X
z<L?-e@7#7;_Z7O6DlvULU%xBP1?0FK%AM=i11hMb0U$OwmMUf!@RoU5!0Z&4Z&qFI
zx>dEc8PJ@ktj)GvnG^#ypq$+ZOnyM+2lRe2pp@B%7fXV_0+vfBB5^ffH@7LEG{6ox
z#5NEBVGY8dpsBSRS98QOKe%*MC9`k4gA9s{MVh#a^NB&5iA?MObtnv|Dn3QP995!C
z9s6rbD=izB{lhkGsbgpa%enDlocmaTb-JSdO47*S_RMJQ#j6E?Y0jXk;0m7f18CjQ
ze?D>N0Y?l3t!gvsF%>3OFbawi@va0WnPa4Sz~*q>+@`--#uYPG4{I$%<W6$;4mUR+
zPz4v08Zg=A?O#MzE`+P0;~4h4UL`M&i03|S9#v1dtuv10DqyfVxsVHYAncctMTL-7
zGT?7}dx4zl`XjeHDK0C)VQiwgIzIx@&Gl8qB;9AvbeB}3{lAL?2NE`y(Uz4iiu;ZG
zGG5Au(EP#M!bIaYBzwbEqoszSf`#<Lgho-+m=+A`<7tvg8N!ir)Cg&bq+VmPs~e{9
zY>*+6VajiLI1|uT9b<ceBj%BoIpctv{U5_j!FcBxEHikkGA_FG4Qa`+tGX$$Tr)|0
z==77Jg7~=$ScLBNkutm9Iux#Abo3s9q=rlf{<r2#+xU2`eO3Tq!NXg*WIcbtXp*+w
zCt5#{+dn4-M;pgwT6U_^v3Ab&AT;QiIeWF02>NNX{*vF}elGUA1;8}TjDk0Jvitu6
zX9c<{iY*!<q?+q25cY<DQg1+|nHEW3d;(_4Xnd_%sy{nc&HD^%A0XSP9~d_i2ZiL$
zC4$bj#|oUY9!Ua-qddJKDmw9)CdW{vJsyEa7e3=u^fcdDn=Qi@ovIsYB3BhlS8}z)
zzZj8^xpS@5U+(6uTaSF$t9&lU36EKo2c~Rs$}DdMRnif-gYFC`-UU}hAgUaHzgq={
zQN|8_J<JE3NPn*7PZdDZcJB57UX_o9EM8Fv`m6R5;1HyeZ(??HqRM}H0i+8oY$+*Y
zH4mh>ZazLQXB__^Mk%q{xWi~q8=yLL`ycugo*f@!N!b7nM#%ZytN0r&uvKPwK*?3P
zCKT#Etip|^HLDeZG@JHQA|BLM<Vrn%H_d(m<F~AP;IfOsh=bRX6rh&<d=cTeeT^R@
zhn)<Re-Yfuhpc{s%+<}(*@0^W?-B9|G1p+GD9|1!zcK5>L=*IZSu9ZnJCVtLKnCR}
z=M$-^VR4dyFGQhAg`@SEi-Ur>5BdYp4wDXW1d;mleLuTWz*iWz+1J|L^^sbCp<zW1
z8J90l@^sU4FWTC-CAB%j36?ok)HOtaw_CAnWs(CW@#9_ubFne6N|SqsQBbC;TI4Th
z2zUt>-qY#o-dj=Mab+PZ`AVEgprl2uBw)$U0etd>SEAKMRMFH|t;XP6!}sjVdkzc<
zxegypB!(kYt3g)fSjQ4KKIQr#%G*}JuGD&mg-(&;nrYu{d9(akK|+mNQ-E1b?C&Nr
zpeUH}2DnPpcP&HKPyS@=G5WL1gxHw;d)IVx$5rSZGmsomuP6I7a7r1)FZ7MO8w<Si
zRa|4n<3bBjtNL%i(VD)o1e;hXjfd5wd|`-HwR12<IHEz+Qa63J*kzyuD@b|b(NVdC
zaJzbmSsEO2+Z5Rp5O2FQU03{NIMl8EulI_gauvPK%Gh;|x*BeCw^@}?|D~pwM`b9J
z$;VcF$YRqP<mQ(TZW4Ac6q6)d1+8qkN)qV(lI2i&Y|W_0HsnIoPJl~xnRaTiaeiCB
zVih*0#BJ6s9MI8CA0FX7esnPP2L>3QrMtfqnZTGQJ0F4bF;1%?ZS5biHGA(F_TXe#
zl%hp#`)NH*6jX10+yDY!vM+%dA{TJ4Nq~K=ihc?3sS|_uXH%>5aT8)_+RPu-U`#Vq
zFMWR}vCE*)nJ)W|q7^o2D{<Ny93E=2uK0~Za{0R}7!=Me@w@(VZmyAgla8L6JV4)2
z@6oN9GQ$Gut-G+*ZmfJ=RnDL45dPry6y(^R4|F8yU8HrBS9!wdPKRMZW&1TiBKp{Z
zQffR6yTM4{*Ft0iw+6Uuyz?szx&*IMm#`Ndz<_-Q+C_(!a<9|bhD;L8w#)7wNVB{e
zMoaxW(FLH(t|~PN3E=kX*W*tpyMQMMZFZ_?#mMLfc`$!yLpR-*UF>^YdyGg?o~U%W
z`u)M6(ma$4t6@(9DM105D&v!47%1IOg>4hD$r!-jZhQ@X-zI84WygO>3nfQ{<p=(G
z!^n06-vLlJmhfQ^e`hUy<zhqLCspz->yX!ra?fHqRm%XAV<@g1Uv1wmp72a**&Zs>
zTdd6%`X;aI)nz^LFs4H#NqPa|@M{tQcE=#=YU{^i3d=!!%dR6?2!qcz_U;u-eljYe
zs<ZO-d`dtCZjMTYvX9tbf_XQQaY2~EopSzR7AYI_y?n#^gz>A?W5NEHKT5Q+GEYa%
zKZINWPApJ^Ra+N-w)H1Uxm8GUj1NdyRa2pH<^7uE7Gc?3@7(8$BZaRh8=8+}Y=a*c
z60tD_{*^Fo7mHWscT-D7hn@dmoUv-Y;Uz`(Th+N<ivD|d@>go=-ay^R@wyVZx|#Zb
z|89BwwrN?DX$9KV+GRCVK?@kem|>^Uyf8t-TZJph7*iI0c4_?l20FM7%Ck&y#&U^C
z5t>Ebx-kB9(DJwPU;kUe<!bl)W4CF3V^sp^Lgy<Mz4I;dG{l?8YCH#8STAeiDLZuA
zOPo;>1Rj5obzeVa?Cy1ZhXDk<D+xb-PnFOH5Z-`G!$oO`*dSF72gFZKu9gIf+mhC6
zR5jOMZkxz|GjaWIYDU>Oxb-@+x+?(0dk=7YO}=>3<vPmSfgW}#z|>1h6!)a=n`J$D
z{OGquLcmT(y|In340O{}rvPw=8dm4Nrvk1kZ~UmwW`JKto}pmANb;!68&cIB^ng;a
zep*3Dh`S>$SoJ_cX&O2Mnj;>#N_(}}X?_`=ZoRaN4l4byh%PF+`Iy#Ly*Hi*8)H=3
z^@xC;ky4=OU(5HcGm#uHH2n1%3zS%O`+an=WL481fMz}c-;0rOL-ygp!Ip(qH^YRK
zo9~ZTz~;Eo1z^@^N`U5{)n)!HcJ+$Fq6OVH+019R**z<T+N2$47WO+4IyY9sh>iz(
zH#@1NK~#FBvd4DUU`VAEeErqK$dub=jqc6^gc0b03}*mzK=Xi?M;5kQuzBg;ebN$8
z)Jp&&k=i=2p$(iLeH)SJ7&|V;cnkqL?Yg<t<#WrbD5HMgIzQ{l{xJ26s_i6&@&bc0
zyKlqdVvS}nu3M42C~9a7T)#1ptLLx@XxNKA4a}o#4v__-ev_1LE5CdPoHhDh-|RKZ
zw(}%h69YFEgZ**`{765bD7>@z__{Km#i+jXnmXG|=O+W<#DVgaR=`5{d#JT%vE%kT
zx1u<I)$C`%$URYpL*P1ady62^_%#WT@xD4qDD}46l_y_1O(7HD13AAqb|+9&!By{b
za#;+F^h_KMbWnQ<71xd|rUDaORSEb<5=)`!^izaC9G+D^GPeheB8Da_BWmOc&3L|=
zTK)<3ZJYRnrqrM+^{ltGZW2<n{1Mz)7uurlj-PnSM3@ua?#z<{Um|)})*w7qR%BLI
z)Q#|(CJ6@l4OQ)Iyc(Ar3niX8H)EDHhh+h6IzOeJVXjqk?-AdyG=gCOxON5Hl~E;J
z<s4$Kmp?wR1w!Of!1w&jPPr?3`Gq6>z4Ba0DuB(~1E1KF57707R(#taiSL?tAJ(^_
zRs#dCds1(k7BS(djuE(UlxxEI02E9EaE+E<d{-yf_8j{4tgkQ9Um`<qC`cX9A8SPb
zzS;@sez&|p)44=fC!u$d^9OM0Vv3Mm>@jf!Lkj(-1S5rN1jfdMnwD*70G5+q&Nf`<
z<LSIKQE<S%=FhV>Yep$dBmu^x8{T1#%hrU8>t739qEyf!o%Rwz7lmS;qGUyl87Yav
zW%W-WxHA9a*=3+vE+@d+pU;8``90gvypQe->7UhPSa0l>ej5a<Gae%U?q%J5)^ujc
z`lH(taI&USF&NLDc>ZyvrFW3>^a|+5;m4=%t4)*w7g2akRl%Ore9m}$zT+Q~UIx!0
zO#}rOYd5{-;%q)qo5hDrSmnGNf77t_uUm2g56N;~LFf;tyt&yO@LAMCK?4Cxjh#p(
z=t_tJvbwS^a3&8>7%D`imlpTNIGY2Dpk<MGX9*ZRpXPNdE30Z(qaw@lNbaCzF(2t`
z6*ct0iOEs6uMzV>OdLqWv(bXhXIy7%FwezTeve&ehYqjC<9>E=R2PhpR`%raLbcee
zeHWFXSn&s**&>}3zv&j?B`R@~0$#OV=ivdQrP83TbSU$3=>Oi+{?~8B?bAQWM8zVJ
z!u*k451)co6yUU{Ob208Qd09x)>BqA<PPaI4!kQ`0L?8^D*|xp^uQfErM#1{<#Csd
zLr>?wtOiUwt-Z0sz{yI3t<1(~|Ec*?tJ#?2^ihjjc#NR_9jm>&3%8PTO&~kKaZf?B
zTF8a1Zvuy|%~Ozann@JMinHZN_WZ2qfmdn9ZZ6|+FB9NrL7KcIViCp6HisV0IWWAu
ziv#3>)wMFOz9T7k>}^2*=`spE`ZBJc8o(ey{73FO9X^PF2nq&F!KB&z=HWwyz5|tX
zDia|3k;vsF$-@T(@P&c^-59z)Xni>DJK%d)bpdI^($ZIp{V;TK@L3}Q7&X++;vMOu
zVhx5In6^bl<@h81SN{Arsbr!H7&UC5&t;CIVpT?70F;`zxa8=ENBD})0=M7*_f*u&
zh98QA4r1l8Jdj~JI=UYp*5drbZ~y;K6Vh@90q|~Os=*z5`+$?jzlyc+pUIfI&jXw`
z2ChAM`tAPvg8iQVOt`3O8ep-&VCgVlzLEz2b-pxM1>MNGgY@Az#yZ8Xl@w2-<PKT5
z_}>S;_#80ni5im@$HjiY9zA;J$Mm81pRkQ-0UFov<zeqCK6n?@&BogvIDXw(8}*6j
zpQ~Ry_@CM1=ue((89z3E<-fn@1XnHaU#bl!uy<bqxBvLhHD11WFf%WCKi)PGzxf|I
zHz5Y3BRpKx{fSltQIRiT`9S&ni2@REjKk~1e@_gqtb^kR^QnqnTI-i?19B_Fft^Hr
z=FC(82B3uN$G<<g>t%bu^9oe8o;86qxOl!4H#+rn^qW|57`LZH@cG?wy?eOfr*&+C
z<4jsSsrN}Sjr_j58FAa!UJ#1BNxrl@+c>?D*HJ5XF+s-}U<83QtFhEj54qKd)X%m^
zHX%6cb#{+=&V{Ym*Xl9X2V_BHDd_J8zjePS3^#Evp`SwNlON@*%fVvtJ929p?EX+c
z&huC`b<O{{;EK!Xpf>_pZ^<2hh!K7G`RDssem`HS0xP|XDZ-rDYzxIO`pt(!L1?jh
zi|Xy**Q8V!H4{KkUqAl}bMDLu`hXV$d_1DXN%tPqjp?tPthTX*`lm)24rvvIxPf!;
z;}Bwt9aZbO1j>e6ow9<&#M>0ti&uqUeeWG;hqU?i=iLNMB6Z^A#%ew(4{6`jpI}W}
z)4YoMBVK0n`t2j5sO?)GyE;4B??%OfC_JUUJ*RXEV~t{KCoFojcCS^5&p9<&c@<e#
z3x%F{Hi)<oQ07yTvH-u)tp>3#kCLv?a_7w6S?NGGN0lJzJRUkcgW8{ToQwY%u#+u>
z_UAU9Di)?h=S;=$D6BSdR$C<g!G+&&0_Xu=FPPO&+oZ6tO#LbEw19=B{7)(9+N?Hj
z>(Js4r25=@c<_T!ti|!e@9T<s-Dq<K%Xa&tky=#BKm>x+JOTKs^QXM*rj|o~`o36c
zQ|2~=z^Cus!&81+!MmACnz{nJLSnN$UQ{>;SdGr5i`vK`ar4<=3~<ScC-*Ny1jgw6
zJSH;OkjJU2u^>%wgz#3Xe0X%_ab4Dlc@hgNhQ%b{H`9#E%1(3aqo`{O0}Vr1-;eSU
zAqLJwrk$H>%TF|Kxi(Fz@gl80f?_*fQdL4p)gruqqQ;{I{fl&B+2{948pmZ6>IAJ#
z$D_X(Jx;sezmnIkrh;Zmc}uElkUIBfPwa|=KF~7Fs&=q0Bm{wCvL0=4p9j1eJIv4N
z|6_p&1h<MK_gC_H(GMW$9d)}d`_~K#_X>7N_~%_(2R<TNT3Siqe3v0&ypH6wvF)V(
z<+hF<-<fJfm;SVDzyMVkw=~qZ9L2UYkXxRon_F<u3n2YHWh|Z<O;QTYe(XXf#VHj#
zY!*m}$*&Z_98;;h9P^RSTa+Ha3!dPmIGBPW`;fKXeYn(JTw9r!Yy1A&!KriL#G4Ui
zm+YRb1b^D2VAdW$^R&v_!)5<n6Pd|{EqC4QxHqMRNy^>W44@pr_;TOzYEz_ltZv4m
zqNl3Rd<_7d&CMdCZ|;cdOQqHz{2L|*m6LbcdJ^%_xn0VdGA|C5M(ZZeV%<#JB7+36
zIyM^!l+k_X>OuPThUQz93OqR9uPZ3F(%fA7kX)=IN#2J&f9b2K?mEuM7d|F^^L^);
z?b`i1CB~g)dv4gcY>l{*pW2SuNi!AdFN^xT^4UDyS+6sqUANtFFHfi&jg{Wivu(XI
zN&Wm;Aok`og=Xg`=)L#+`h7u#jklX0+oFZrfdeI$pDN$alCD*s{~zqVcT`hr_b$3E
z*if;8f`APX5ZFo+5U@}b1e6kxP(-AcNG~C<Q4t%k1tLmS>4Xqk2rY>Mg3>|@fdmqf
zUP7n|5R%-*SI_5$-#!1_anCs8`$I>f$;!LlHQO_vIp;gxby`XTKu78g_{&}lV*ys6
z<B5*T8kOhlDb~Fc2!F#k)s~XLJ&b|Z!~lUReny6(kx=6!fRO(&a{tgREucLF`^4qf
zIV7JmBxZY`u}+-|B;rgVK!X|3Bu_F2Xp==sA$F4L{@g#(V+#+cR?IWT-@W7*&{Ocv
z8D>!#ayZeV_#Y!3x&ndRO5lzf)OyW0T2!?x_UPxGKvV6l<~Al~TgzN)^41|;f$lEj
zqn-2SQ;I<6YnDN>?v^bt{C*A}N1%XdEf}$r+R6)I^JT%S4@T59)={3Juq&OC)p(Uo
zEj5-Wq4KQcL1;0Pcb;vp1rikWl%tBP_Anr}w?8;Knn*kJ9njEXB$-=KpJr4}(wG%q
zrFq7lO>t{VG`m2EM3Iw|xb6FIA3b8EUOi|^Oj%=w70;aT_d-~*lK0%?*yZsbuIF6T
zcp*14|Hk;UhGUqVw((L$-sjsNnSG@4S?bd&EnKSEm&C)lwNWIvqHnIbB$RhL-2H?_
z?5ZW?;FYBwLq}w2cy`6^i=>(a>lN^Jnb{Wy=xJ%%&f!dS8<xE0F2-r%^-X28!s7C$
zzfD!mB2fF~mPlFn(1M{Ou!Xlub?k4G+WCqK--I!JEf-BSf-Od<crOkc;q*OWqECH(
zE}j`a3E}(6XSEY-J1A}yq<CH^y5*wD(F#O0Cey+F@I48gJ%JTjYp5W>pkz4}mZ94K
zzbvonAyT0zycl1;|K_J>TGqw2i{j9;=r(jmdGnr|{sd{elKIGC(DwtTYW3xP`eN_H
zNmkzGdHfuqX&^1~Bz<LSEbNw<Bk0c(vl<7RA;%HZ^S7Qsf&MPz@>u`^RV*%4-#YS6
z)r=5>_d+(`pOGvbeWIEU7CJ0#5UDOb*JcRxlt_}MdwGW@V)M3uRFgGIw-x}dE}A0U
zx$@Rz1W(g@${N#fwJCkLr!wtxReH;lvd<nYM*1S*silCNhXSMZ#w#c*GXrs0N{3o4
zJ>MYfi1gu!#ZGe-JzM-Q;lC<qtytkpJ%}^8%M=y(IL$|U)IRNEk>~fcUFgS4Y{`Qw
zmkkvb-nK-Sw(;-1qQb2j=<eaY-EynI*R^cvB~~$3wnn~VEW6EX2@MsbhZ;yN(BM+7
zXvaH;Y_#C*YDQO+?noE~@*uY&lrag_T>4E7l&EnogSOW!#tP%_m5egt{cz?OwJNpT
zS>@h1cbLk~smi%MGBZ9dJVxvI4q02IY;TOpl%Q1>z8>LLH)gCtfk|J(7KS2!vAH(u
zHdp0T_3k`RN`Y$zT-}0sK8lr<E|m=+Ll*)S#td2g2Qzu1Flc#}3s9$%vrgiOXsJF^
zV0_gQ(AaDR@UypXi7RvsY@b>ulE^J-n!1%fnjZn?{XEb<kN`~e;@e5<0hmK6U`7=v
zSr8R~7R;hk(Wy%6S|zhwpex^vr3-PV=`5UUA`vX2!G0xN4Or*-5kjIta#+6`heAyH
ztq>@6bP2zEG4kji@2%#utz%?878fOppdo*Ri6&dRzI<l+1-tu|;cu>pV2IN~@+Gxv
zl82?8Qz@5TT}|u#;fzKV4<{W>OIs!zi>UKiMJYPoje7_@FM3lKO2)JJK-8=z$pC{M
zL|=7(8@Tk9lz^+}e4vxOU!b8@f0US2IYfHu;ch=f=T)xdcOJpHN3zm~jU6MSEcUOS
zhkZYg1(U8<dz%9}o<bW$ppwp&Uf1-EF*d_{YFz$irdhuy5fgi}Kx>R|JZp*P%qXnO
z%4cfDgc}96JF47#o|?OB$EQD@e|Y*h(x2#V2k0+~wBJMj?w!5b(?;6Yr`rsCtA<#i
zq@pO*s4j(_@87e+#KZ?vuq4|lG;_Am8MRV)#nFq-KU?6T7d0U5x4f6ezm<P`YkgC@
zN5IX>u=nvlYCEey1tg`Nqt4g7Z1gBIa5)#&jJ?BjJEj)fT?F0#E+t29%a;c?d_Cl?
zsA?Jm(cWXG21_flQu!C+W8O`OL}3%28{`FSS%%0{_|r|Wety|dSD)ETe|uD>-RRj#
z>_S(+Qj`(FB1eOS!a=6R0toWr`aRzWK8szxFJ^R_NwJcZiRT>fU`l49Xv82E)?7PE
zn0zM?`sr$(XsA5Q_Bb73;Uyn1{q^ZUUCc+waOFvCvFbvtQ?*m_N9Jn-JT@*@b|<_t
z(ZDcRQ+B(Y?ZKf2r)L8_Sih#;Po4A|gORMBx5u5lO!FAdXDhkU)_)F-VvEO0gLDd@
zUmobOc1z4SCa;jkm><|MUnltw9^%{7aTO|kFxwgkxR)S2m6N*AI(!yhu%wX@j)VWO
zmF{(J&_qQfSCUKD9x^=qweo;rt2l0?u|pbPc!QcGw8QyhHSsG(=y-tN0KOkqE;8l(
zA!ntb9yAqo4;Rd`y-8%Lstp&1`VZi*BN7`XSR~j|a!=^N94(q*?+2rB2Z9luaB>iK
zgC{-rm&8G>-O1B+?9Z;n^Oq?Q44Qq{MuvgB(wb$_jh*KLeH8u@&iV!h{>vRh)*`mE
zqCv6bK@OM^nmOfF)0O%_!sF-9pVr4uRL6><YAzeHZYLE8jn!mp1TZqdg*?&@<2ZO{
zFfU^zNh=(fVdN1R9?3nP6YZb%NSL4D@ZiCk<CC^4o&|>vANFh1h;>_Nt#WBP6R5a4
z++(5K__&C`O`Y88uU@dX35OAs&a&xJ-jP}v_?CZ56h0mCbkU6{m+XL;)vEX%+3?Z>
zLM#_LhkvA<&ELIKBY6xZ<oPk5FD@X+(KjUBra+5&+t2<3AJ6u<AnM99z9&(HMeKp|
z%Nig^N=jkcVS{eg;|JkE5PILF6=k`!GD;|h>@WC$@+$IkM&2M68N_^SPiO>Ls5m;V
z<x9+k1PAG++Gvf^t+V_Q^QdEDt09F7i?%VAmpzw$Ci_?xt*$OFDKY565WX5t-zfG5
zO&>i_Sxdyy*fgD0uB+Xjs^jmMXb+1Zf|h@ZCR)-FiQ;z-<rPCiAKgvjr|&dsCAm8&
z^f!w`?>(R`9z*}$r~!!<wGF}(mULF9pCt%?!P-=>#Rp;4&eb8yX&heYmU)!Cq)P`~
zN^SVfR)4z1%oUL&1$mGC7p4|lw%n5@#CCim_?q1tm5J(VUvOnD;jnkqTgqv{_N9Ep
zomA5wC+H&E1s_0{)<mG1bPAuc1*}cB2c)+Onv$>h&We6lb;Ywk&nDju;G32d9%+JP
zV@S=7P8C9@^{yl{Y~OAd)58Cm%aXrI`5|&VIyfY&Fzg*XH&)I75$Hh44k9<#!n|f-
z=cZSRuv)7F=DD)5=iPh8zKwnv%?Q|?-jJ3`Cdd!M9MWCFevRO+2Jve@41&nCqAEs}
zIm-(uZk(#JVZ<OOdBN%1)|oNeps&c6D1=9wD8@ER6AR5PDKXi$BlU+<mDC`I!U)TB
zhg5W-Rh^j*Gn)KDvP3QU$~Lt9NN~Z~HW?Il2!yrs{i@}DMF%w5DC1gcke-TW7h-L&
zA>d$I$}D%pg4QF88IWh6yY6EWr^ya|ap9Zz#n49?#-6Z2Y~aVp<?_iMkSj#J<~Ex;
z48GXkK8Q>~n=jhl2dmd$juw?aCV`kC$*Ca{mdu*`o0M2-;^K^Fzy6{<WTYp!nw<QW
zd@EuwxGm5-WbP*I<xg^yiXdbJcHd4!#Ewpb4!RJ!0MV>nl8MAFBneX~O^j2hl_p$}
z5?=NWy5wZEDAOe4!9deEd8{GFyjqxxRw1`=q>SWGyqy4@XB&J_d~~KX#NY23TUVDC
zwE$nRsS)I;^uf=}_m7=`Pt^K??{O)J-GxUw`#-){QWo=cxnNis#n)`7@sod&o_r*g
zd7h*aA3uP(lvF)Woq7egRCTjWiz|hF!Lu&(5J?;_DL;u!H)u~<X_d0&5;N`?hiE0#
zq{0j(bCM4!Qw$`bD-WYs$iy2tBh@DI(HiNDwB%9TaZ}R8#c1n$FH%0Ac{fXKxD@z~
zArTKZXzI;(qA(Xo4UV~fp09V{ElanXIHVQhSg-f!1c{GNz+Hjn5v4KT?mI!W6oNV+
zFubkv&|hPXS}<VIpa^Fkkwlv+Sl|*`+cYqCIjPX;lQI&%^YyR#31Z>ncya;Q*~XV6
zdc<DxpS1v@A&e)+Q+pW<9NlVZy3(Pvj;+PBDl9(S=Fh5Rv`wMAVknaz_0qfJjkQn(
z1s60}i%*g+agJ*!kGKZXj+-*PMMg(QMyjLTX}lk%JpRZrXN^z!`O^E;XUs6GIMqRH
zYWQ$_yxWzJ5su+uydn9o_4R5|WIdP?LkllOL@s+_d?Ud~ZvW?kb5S**ZP3a6xVRgV
z7h1iQ5T52WaI?9l(V&l@^zb7HmMZSi>QJ-k5~u6dB=1gyjIRSCLH4}ZMXg5hd@Bl7
zn*JGxp?2~wb~xsh{Km*t4K4&>;7`4;4OJb*6?;!vJZzLO*quk@!dW1n`X)@-@NDf}
zR0E8zT+^vx8~kqm@v+wNWbC!Rl+mZbvJ=kq_PLzC7pp&hCegxNa&4e*6xbgwEU6*1
zt5e3Hw~AL^1+{9Nt0OWob5L5^G4%OH<ax|WX>ftf0(J5`MLGaniECbw;8u+S@+I_B
zY*iblM!!4gR!EphAF&ng-XA(85{sFqHsO0U`9Wj-@E4T?Ob7?X8d_=yqUCc3NRdBn
z!2#(N_519eDXP?9;4DCx0*n!Z-05rn;oKTHOR1K9>w94sj6RDi9_zxv>}8s_#b$cY
zUZsD|z|G=5hLM**Y0fi`XwBj%4|DoTak#sO+|+8rEz>$EWF!nmvvMuW!R&m(5pjSz
zDvtST2hrlf^D1`ylD&%<Km5FRmYO}!go<_W%i|^|8?@9WKoaN9xedQ7E%PC|2_;FM
zJtwU~!h}>8!dbHW7)Y!Em!aFr^C)(w%s>#M^ves2-ooB3Z-9zIyx&i$F?RZ8Ak;=%
z*nVhBRa<o*WofzC!FY89?mqYA!&LB4U_a-1TKYnMHGvA9$rnK_5PxD!u1KZ?#jqFR
zO=s?o8Hu`G;rIgtru`JfIkS3JeRkJ{TV1_+-()-=IO=)$8X|<el=`u=xQFHiX(E44
z%yca5MU=`~B-Mh*0%1}Fz9~>3WilCTGc9&l-^^Sr1Ck?I8K)w6DP$1qdB1Nc;ZWab
zIV!cnOClI~=rqVV6mboAzjN{~BTVOG+$ESuk5wzXXD@>nqVfekS?r?*7LfB*DnlxV
z(UVvrXKDhehYb=E%#rfq%+_1??|phUN_3+T`nxQoonmEP!h5pxX+{P<B2_c2^y_`N
zZ8Dm#0+ShJw=hH?#MezEd`Ax(1GTgXpd@tfM?^9_3&{!4-sV_mCc!7mYt`1Qz)}2M
z#aOK}53M$0s9H12eSUAnEB1**prrepjTE=N7pL(+UZTJw9+pv?Huw{M(aY2fwI5m}
z!=UTLTl~z%jde9Vka(6x9l%J|7A78%ai{2GUeG~LNTeEpb2Thnggs5OcO}8Z5h#m7
z+kKTeRcfXFnq2hS3<d;MoC~e-wj!w$X;A2`&ZVn%!D1}ND0gJW7t$C9jYluX91&%E
zx9yOqTDRXC(;_E(oKU4N;eVc!z@X-_<F21_ut6myR?JJ^aU=H1XqH+La4UtJ`H%kT
z8UAdS?V90FS%xc$KKuWYyw~;%O1Hc7;jTklfJ~2`XkeL<R&bf-+PH#Y_@pZ45^XD6
z!AKmzmNfJ?ehe=y9{N$ITg8LQFq6T`jZMQxgc8S@)#5!n#luEtAS^Ze?mN-K-U)~Z
zNEC7zPj8Fj$RF@9=eF{2-Ja*%9sQl~zY|iOzi>a_*xybM)R>lsb|oaS0_f|LxZG$I
z`{XgPpwHA90s@30K0kb}N{bNka|;@Q-VK2{`d;t=bG;vH0wE&!gzXH-in529Ehg9o
zR^89<MeiM4HnHfb=V#c^-qugm8JO5yb&HCmfZj^FgK4mWBQ1#nY|ueyRH}oF8)Yef
zF^UCpa&Ekc`?G`6;>VZ@%?iBm)FxD~1Q(*%M|;M%#J08@*AEB+L^nk3k$y9X3Y97J
z<O@V8s9f-NfE7WGT7L6vY|DYWv?h9&B&|h=^z7(42=VGm$!>XN;jFHy<CSq=J?U@|
zWks-!qH?0ZEGDow=)(9S$Ytk_1;NKNP=k;B3)=)3$;X)NjM34`q$O%c0<^&D2nus9
zyE0KApqKw7RM#DK2u1kH&+yE`VNaC&2&R79i+MlyLp9jzi4(uqm|gOu8y*@32bYY=
zYJSDod*1LJg@cQUYsmtO(ON|wF_G&Qjtb)io%uqHVA<w6dYMn?UkLsJWz9*DId(Y6
z4NE%j^WW`Y>-@^x>TuIix=wPUt#hKwn5lAT+7v$nnYy~_suk}339>Ljj$+L>P|jDw
z7)@%;mzBPDxkKk{zFYaQR>M`M!P-oQZbq6`!(?P#X}^L!ZR_t4b|B+3l%I&h$gg4M
zDEJ%Yk7?`^L0JiIv90`!ZOu=DJr&0mjQUbmHNUT&_|-~&JMjG7EUvQ4{!3VhRT4sv
zmJ|iA`7VFn4CFMB{EUp{-?PW;o;kAR^`bCGN=7D70%~H?v$Lg@J~aiwp@2UW?3Ey9
z-cEQz8Sa_?-8b^x28K4`PQi2)&_WpV%e_gMk$1d>B55Y@meK2<hlcfYy8{ynqVIYX
zSmz~I?dM;bcDx$u<{z(o23Z=dpZ7?oKnCydWs2tA%l~HiVP%|5c;lde&Ddz3OK<_W
za>kQO>E|YlHsqFE&Za6)e>LdHx5ONGg+)~HkwBl$X;#jxxJ--nILmyEduKz;&+ajX
z#&oHb_aiRaEx1ju_>En7<xdN}=?b=Sh^IA>A(ISb3NSR`wF$)nUBP+F?4q3Ql`-z>
z)+7a{C1Z#eXTaxn9~aSd@L%eZx$!W08zaQK_$8^nDp;WZPG30QEicHi01T&f67HHd
z-VCCdNwxjTiJrW|_er@%fH2_}g3{vpMQGYBXW53V7-HsmYvC!MGGb5k4(|X^7XE!o
zW=yq3F1-zI=oNoh#V~^GXsg_6+lg>FT11}5w;Hs2r;nWPVMV4!hjpW)KI<~HMODt$
z(2h7oX#U!i(jEdZiAZNQraY9yiFIfC%2#Xdy^@(OS3Tb11Z)0KJj;cMo=_3U`y7>+
zS$Xsuw43~gQl`qsi`%Wv7cnW9S^HkLAbB{U$jD{~B_7bXxw9_djB)``E%K2Mc6<=l
z{#5Z7?(&b%=VY%2;cpomH><PQ;^7mqT8VjVBZ`!|OljY~ds69>llYw1w@cNV`2Ys(
zYQk>I@0i8KDi;6qOM9OE+97zg9$+Z-rn`5j6#e}9z}#$E`N8lynR}qOZ2QllA$VNL
zV3<TQNPc49Uu^C6GXTr_+IG90yU2*uAB0KvuC#~G0PfLV>ONvdwj%b`EB<C~*IyZB
zmn49V>q_}Fe}R9txvA+PPqIF?N$-zqXMh_!d;cSrkNM)oi|wrB_L}yizXq~a27k=r
z&<|aOeo?M}zl{(CZU}QArui?N;lF5H7g>Pq?upB?`St4m{)*N4t3kBum*svHv436T
z>Id}pT@0|n+kj2E`vWc?fg9x?tl0bS)&24+qUX@b8i?#Y@}{FVu6~FF<V*JH(53%j
zvH#tae?OOhzWU#i6d+vSHK=?|x`@9j5KV8tp4K1_<wYIRn7@`Lre5qYB)QYO;pLh>
z$9L3i;P*0Qxr>Onwt)zvvq^el%zR|B=bWw7?u%Rzlyrfa{VjC4hlTHn@B-wcF|<Lf
zdr|zC7Iz(Ubef%Y<`=99{0JUrEMgp~zF9|RG{3f45btN)X;Gp&QET!&|DL7cwNMT9
zV&9=dvRCS6R%Y43A>5Xp>L~x#$Mn)P>nv~-rfYxdA*)_WH1wW#Fj`lm%(`(VDZd!%
zyb96uUe)KwV@zUWrhW)a%8rX`y1w5}Q8jm71c!UsXzX{g4Y#~o$nS*gA?l&;(puwz
zPVw~QXhi+SllOr!gZubS1Cd`X{qq5hcYk8?1o#JGbtaO=_wvdzj}0i5VAYFr3#=No
zYWg`VPc^!fd{}<0F+#WuQOUPwvg(v4u^Rl~N%RhN6b*Hr6d-!|;nd7jh*y#tD`lg4
zpLLs8_V%jwQ<mTwb$Q+jZr)_KXJpjgbEyyF=rzLmVe1;Qgg6a12O;zlwGDe!ZczMY
zk+$-P+#W;Ju*;lyR(|2za?kV+%{$R|1Kd1PM|~3oT_+n?O3X(*O&o~MrDw5Ap2guK
zFc{tOY@=ICMzfM%qGI@cPnDvRt9_AtNopT6^7G9gc9T}Yyy3O2*rJN|B?;M!pfiC6
zT^-e#m0|MD$ZoAPtE?`z<79`xytySPt7X_Sm7--(?KuJV_G(<S)AwhAE1P8Ud?ef(
zW>P<1(}2-zD_m`3)E?I7RTSt$U>4Jb5U=15P+A+1dlssOXw^5|M1`7XvT5H<8D6)n
zY%KGjv8>2dG@+EsV~?Qatc{<;nG`vlu@fm-6_)9JuL<-1ma%5{cBjrax%oH8kl=dd
z-W>E$UAn&Y_p^a8>(}KjhfxLs1W<5RO0#So#nsT>F_qBTBYH@Y9>2Bqo=I-pOE<J(
zH1TT`y2B{7Zb(D`xfIJs-*}GC=Z3@2pU;MQ-i15CyzJfI$V5Geid>YxAlF%DJP%Jf
zkZ}f@o$F~;!v;DZ4*LximCw}hpkdKCTTu2#m<jNKoE)uYi?M>B0gWah>78N*Jn60x
z0<xnJe0HK;Oe%@x_(qUpJ8CosT2tw!>JSQgn%49+!a9NE;gBTik^B~}`X|^ESe_`A
zuv*iO)h@bP$up8l!j#?ALgu&k?R0j%&pN_;>BC<w(66ZjM!zC;@$WIeV>JSV^J|`l
zk!|mb^(g_*NpG;7)(5yFc8*nHF5so<q+EkE8(DCcn9vzfqNKS-^|{Jol`+d@XkKBM
zHxl0(u7S~AkuVqTQ85g}y+KGCPh@u2A4^puVy^RIhRDtO<0-S>d|0PPD+aojrY85W
z<{fXQD;oC7*G00ZHCFF4UrJA8Nkr=3dQD826E%M@5+Y_hlNJHE!9@yr52xtUZ6PtT
zZupJ_@sbbt!m$S1_A6X_-2Pt8@7RY$iN94!m?tTJG>s;6TD^Z*Z{i3(sBQ%&^-%th
z4Z=;e_6wuOuz#}39VnHTqyj9*-M?Uv+X*s-oiAch?XxzfN?taGOg+tSfrviY?QQyb
zm8;w)p&qyI=~+oIU1tlQulxC@@XMtw11dSWgUq*Uce8mlZ-;F6_GXuckD86QNP;HT
zw%j8-mS*l?KZppt-wKt{h)+F)VC$i1uSvGsd+iZJ*dp52asHjFwk~UMaGpXo$`8S7
zWF&u_8Y?6|rs*p!l(l*3K+Vy9E!&#Q8sFZUq3jf-hL;vt2gZ0XYI$!@*vhg2ahgon
zc1dY1!ci@N<R{vtVt7W}s_+Hp(m-?6keKxh?#=xyKaVV~24tj)IHz8SV1zSYn_Gb`
zvnC`10az5V#2X8}n;AuI?lP<+yEO;wE>txBQ4<0~aSmk`jyWx!k?B5lrU!eosLs}<
z*C48Ne^d8IjUGl``yqkC%}#|%I(+~*vF*O-T5OoK_sD&ZuPl}3ChJsx{s~VwMidl3
z0Lq~O?jm5us+3uU+#efj9{qXkg)#qPw=<ty4QsNTM6zYcy%3)JacPNmk;wOjg-^~Q
z;iP>AE8%q4T=|}CAu8q7b9<J2*Fmg_(%c_Q$<<VDNFj9vXGuuy=o6>fUH%=s(<6O4
zTu}G6Rkm%iMCBoca_{Mq8h!tpEO=6}gX6U<W%t7<s4f~PlT25ICn?)=RQTMq%rLkr
z5Zqj|np19A=q=B%1`pWXy@%{tb*wU9X4Zam2c@*7;Pj76T@)@cNb*X<aI>DliNz2l
zKWmGvjpXlA`DVfJ{@$9zOA!lhjsZsLxK8Ze%b%R{XM)a<;0l*84(#lSZ&cSAJ{^Za
z7&`MKOV*cg<41Gy(G|E_m2r|0RX#&1U8Zfbt$lpxIZ$x#Mx{tY8N2o}WPit;#M79!
z$TfzoA*0)%nN^*aA{w85m$8-&mGK@DC0w}Boe(>36U0Cd+<^)P$S<RBD;Uwwf(Hjm
z!Jp*RuT*!q^Ba&*HMH^@kHM!H$PcX52OlxS1cAK_<m)@MR#IZs@uhYjdavp=(g`A{
z{JqEBd+=vSL_7oCrKE1lh9m-=xScQEczYJf#z}kw&RUgCyrC@vrphkOVX7lTS2U`N
zz7abyR|jlUdhKbC-(hp_Z~||4sMFx%6J4QNtjB@iNCvF#3&0u*4S}XfN2%b6%y==o
zkESd__YW$LILAarG-|f^@-UU5i}f+9GC7|bRF1i!YA}#J@8~`BAv8mI$}Yqb3R5<o
z4?lb|*H~0&vueWVUD~&Uc%zuFh0j)7y40mQUY4OKd&@u0QkzD5-RM9V;_vo(4|BEU
zLJQa4u`*2+#%cZyOy@EKar@k{MA|+ytL~+b&F}8$wkyBiU}57K^831a(P)d;vCtL^
z8Ja#hC<>WLkk1Rqa;#Zsq{k0V;wZ)WML-x}n^y<u>g%xgg~PGLxpe;!$*&Zz5_C*M
zEjv4`D$M#`VR)N0axv3#Y4Yv3atyjoM&x1gidUEBHIf)zhT#x_Bc|ZJZi1I)KnoNB
zz-Z2f({|GbbkPApSpjbNf+CviO6hHjD|p?+6KQni!hILC%t*ct5~1XruM@Zqkr`-v
z_eEc^zo3-A<Fx~?uhu_hl^>jzGPQ7Pv7PWz=sxy!ye~4+?R*U;+C=u7&0C9)fI0SW
zkC9q+b*v1#XER97g9Tkf5#NZTq0cl|^SaRx1R8rt&d`<cI8dfFKJLKO;{b-sIGH?%
zjU<(C9k4xO`TiIsg#;Ri?UgljU^dMHSsAWlKlQkm1eU)0zS0as1BaD~9*QKZ`{_SI
zk1E7HK+m!+Ese+h(BBa$U4xn1mtJ=JDBR}@M{|n|8L5ngORHh+vcc~mQ5+Z$p}^mt
zKy*MIbD?9~F{nR~K(9v-7S2jl81if4zAqHR6Eg`wtbthdtRs&J3AueXl4`pB!k>NW
zc8H3x#fd)M0K@x1cEF|~mh7xeGM@lq`X@E7Nh;4r<S-?lM`oYgzA!jswV8j>jCj7A
z;rRy%_fW!Bf4~xTqF+}FS<nm29a|ndG_YKP8pQ(XR$)$+s=Lj7hUh@a&nX*!PXt@G
z9#iL*D_(ZvC4Ur<Z<V4OuADap6u0wFP1mFYcWz)mx?^X#T8-sh%qe9W`gbabLuuZo
zUSLfKjw;K$OMziz<E>@6lWtPybd!pVpT+DyAMbE#X-Ise^8Ubn^|ADAB}53jp?Oqs
z%)x)6)P1paexJn(`1nUw_<7=RyjoS9Hr1ZCt0+#l{4Of6*QvPN;*Urc=rA4@QXuof
zLC@#<Ys3&lUUXWRlK!Ehe-HZ`5rvscfjxT5%hLVeKp$&R7QhWfqeECwTIn#_US30O
zd-ouuZCQ0Q6zURlRXdWU{0Qvtxim=O^Qa{s`SWGI8?puEv&Bch_L;=Pt(2moP#_X}
za?Q(^j2OU=+PWheJ!>N1kgXPzlpPoZzcf+vOrh?+mCtOe*5&+sH}ow;pONXb)xrsI
zB*Z>6xy&+LHS;t3o?)1J4wJh*ASODmq>2px>^hx0Rarb9u49`8z4-YhyJ7o^#>PtV
z)a2ypTDIhvkW0hb<2zMPVc>H8D@9jY{$#)9(>TY@j=(f&jW^VmMX2kRk$OZ!{h6x&
z2FU;M3V^XdRER@As;wL#E6vvhUsx3V1?m3t?Q>-Sd+$p1mXTO!O4JeVJ)<*mYs&q*
z-uR>Af*UXM<bk^Y0zRmey7yP!;h)#Mdh!r}#n0Fa9^Z79%~fq+KBZo_-=$-lNcV3M
zHxB^y-cRp6+`DNV{Xq#J;c>U?`~Cm8`G2hfK%S?s0oCh=oZejgHB0ob6pnTRkQ2~0
zlzg(813d72d&F~o#;c}$^mwd^XP>g|K*<o;KgQ=3!mlSD;kWcdnOx{_9YIA%MWeo<
zx*yva_-hl)0;`tj-)!@Q%Vrpcu4j6EXF|_dIKs`V#@m&@D4R2u)*}ohK6q8=ovDF3
zFYf;Wdfgm8+HbNcALQ0mp5FlBKUiSCDue0NYOAoEn9LyO2V&|$?>TV5r#nvS+d%!m
zOMM0YGaV^0#_Y_i3PML*n8#C(ikyjlS9V)(=@zj9tDxf2P@}n$r42Yo*EU(V6tIOz
z;+1NvtfR!Lp$ev~7p9mW6>5(JjarOzJCGvz1nWDwl4E02eJ@f)rViot{)y{<+579#
z2Y^|*OTHvGE-FjzCW9z@H@pzpE)@RO^?vM;ui&_WJ&oCd)I@W$YH!HE7nbZF&uZDu
zf`V={LOLN2t(&*aR*``eOyth!a~mgePEKwIU@zW-DU6gV=+3;j6xC6F3Dy>O9d2fZ
z@N_GX(=3P%n4IRXGEOToc>>Lugv-AwyMQuz|GikvCF;mJ2H@QZ#nf1<w1N>zI_CPf
zo_BmmlS*0&zKfM%B#wY4Y4RwdxVuck0U0{R=4G4eWdmmPZ|s3}Xc^BUv?s*wF$19G
z{t54@(ed&Sx3CDn8EF%VM6&PHS;OhXtk=Vqq}V+1F;{A$#LQZK#jzzu+NT#gmq9)F
znzEb5ZSw5^<`CJ-NMA0yYAk>Ljz2o#h<L{E(_=iP01p2vesgPEWLdpsbib^j9wV;&
z%gzj(@`W1t3ktN$uob+?*RS<11mt0VUA#w@#ER`F#bFb+t~s&O1~NMNMEs@sJz0zW
zQkrtQd=lmWbGn3PwU%76QE)~Uigbe11FY<NzJX>EL1q)94rHa?#3~R~W!Qncj&W0~
z&rYIIugpRB==v%)!4F0Jn_e#nAdAP^(<;XV1t-~Xpv9h&36i~b#Gm)`;{6SUv{w7%
zgIXxU*y|Ju9-->UyB&UKy0vavCo*KME>yG#78ep|;Dc`QHON==ye=tJPmx|K(RUpy
zd?DPfp_9I5ogW)6-SH3HXt8H>IVurh=$2xnak7s176S!=^4eypVPUmrnr$wJ_0LSK
z`uj)Pa`JE9Sk0^y+A25>HVomP-^sj5bn2T+n!lUYgc!cQ;1FPF>U|G>;i~4toFkl!
z@V6pOPZ%TLCs!H8=5eDulY9(Lwg=mYAvt;e9H@+Nw4DS8^C(Gs1~^WIG8g>@Ki<=S
z9(|YK^#Tx*kJ(`<3|p5)nv~AMTfvDO^P^!;K08;fKOvsey-GEw`pV)$sr>d*{#S|t
zjJ^99$)h#GK6#wV;Nd5stV@HvHl{=+^=kyV3w{AMr9Z8MXm_BJ^yH6k06J3sYK`z3
zP~<VAwVtc7y8+9i_q~fv)uP9TvaW~@NVZ~s3;tLYqyEoYfQeVvvn0Q++Qlf2sFo!j
z31}^bb@kVHl+Gj{v7d+R8Q5@I+iwvE)`L=rOqn>lU1+hP{wCB5J`Ada0{om-$#v07
z4>;&v{2JmmFT^XlP3^pC6!WJ4AeQe328AHn%DOIZYwm`ykE90Pd}|8?Em1T=*U}A2
zzB6$4FndhsD3Ezs0Ll|QN0tBtIQe#vzJ|aN(u(!n`4Nho;TY~L_o)W#REcPL-&8V9
zaO!7W37S^^ea8844$AC7=<6BbO8b4msMs6GLXPHp!~G28fXLX$c+}AmB_LvMeleZU
zD~uj)G`1aFo$GypBd$g0*?3w8@#>m<G+=JdtOvC*3+c950KA{MOCNZ-_{`dk<}iGt
znRx1q5$m;;Rv7y|%(u3d-9Tm&+})SH8)t>AF1D5U^8~rZ-1D@^iFB?B`M#Z76f1fq
zXpj@Rt<?WB6SuN36WCQ$K1r3hYZ$yAakkZpL^}}L;JV=u=q=l8@2u+pfvTT-o2_Wf
z;N6+59nx#`H*?Z2ct*vvARiO-?<Jl$uzF)R0lJx9WA}`o!Db}nE9|$%S0dn@eT5E>
z0i*<G;Zmm_|8zF86W8ZelvwjpDy!ONx!k~l8pAi>h#65;9k`bx$Jg198O5>?C+fmf
zjD2!~5G6q8Z2S~L6vP|}uRI!Ze_*r#R5iBpm2cI-GYcGnFZs|3Q}|Kvq~!4)27RQl
zh@Cj`+%}JU=}G{PVn-mV(}b!uNt%=V4BuCXH4fSx0FoBzJkaFUg$C=b410M=4{FRb
zJin_4zN3W3^Bt8wnrIH3@mI{OQ7!3Is`h+8Z2Qde{YlClOtJg6I(GIlu#c}zVYJbr
zAwtTY)RlT^z(}rx6Xglj>1v%guD^Ej?`vaE<u(RUS97<Y1~B^lf`V7X1aYi$Rm?<k
zp@W!ZHj>ilPV)?v`Gn0NjNbBc47HJP+FA$Y|3KpasNBd}`~mb!foB}WS%Kyj$|zbu
zW=10m1p4JjlW6fSl~!>oO|2$1z|tai02pm`RP0#7&Sxy(S$zWAwR%f9TzF2!IXnid
zhPB6h0boN|!|P`=aoKb1Lev6e3x?<oF$#i6JiBm0pllY9ChM*Hu$s}mvNjIPd6@c_
z{S?|~+ozU6v;<~@M)`G0z|BWlQAQ!5k!(EtwA(cKGZ1xa+6M8~-cO~!A@aeKes|0=
z8qhM;TfFVr;d?A!K%KsEz;bnYm$nC>yIFcyDsESMrDX!y)DCX}ISY2#<pGtDx_Jd<
zo9IZEaX9G1M7m%_r#!eUI#6NlORPlI2s}m2f(k{9dzN-n2i$hB1CSOA>-9eH%oPA&
zITgs<D!qg^$+>NlcLS=ZRf7l8q8>L$jmB1X`x~#%DCZSdDSXh5MVkE$ZHBpt`=jk)
z9_MQyEm=&BXU109bhWb;t&UiS+To)!$-4!qDp?wc8;}wAXY{!IzE>|57Zhn2N#W}9
zfWDN5P@n<=cbHrq?M8oBU3N2`+8WQ=_v-DHsKEuoZjFt}mxw#N*X`C4a07iviiC@~
zeHP*_M5K)hWOmq<9BNp=Y>bp}r@FbSgt^rs^gWmllH~`mi^$e^NmTc!=g?B@lTvFb
z5z1|%etkE3o~loN9qd<mDc(UT1hv<nk@7*Fdm$bGahFtNcQeF;<O!aq-4Wzw>HMX3
zXz;3+PVlQ*wyNEc$|;C?d8$Z!<e;Dr_&1FTi+r#IxAy00%w$--m#c6oX_dH4t+TKY
z0UktjW%ttKA4BN|if$}FI^L!PARlrq@X}0(B_)CB^D^J>=a7u`eLO`Fm#7+`7~lz1
z23-`FuVJJdA5%7@))>~vrDDmR*6d-a)FUDpf*MgDSBtv-T4wP#X?YsEj;Y65EG1;%
zL!ve%KmCA2^uDR&(XfY(#xp?<NGb={9UjBi!xE!WJ)gS`aynopN&$>2cPd2(v;bHZ
z9~*Fh<-}3S{hnHO6^JCyLEJ7^)4)F*;ESW2ASr)es%7&|P}<=5;yUHeumVtDiu+gr
z(QXPz59vcG4@quI6#J!RM1DTnrcs;ZL@%l=ycqmM{sOWm*cdgB8G(mXPPJNNIX1=N
zuQ}z$odBMkgJ_B@yO4;wHb5;zef52tR%kWuR3ceC^>L@P4YyyIQ$kk3Ox!9i+}@VI
zrq9EiPwJ#r8Y6u?`!5$DL;UXX44*$MMABVZkZ+CZw9$oR$B{xj$c{Eir|@UK)%@R(
zsFM;S#1iwKzPw^NMdVbG;T?-%^D5d-FI&oqJNzA#?61V*zyf2Cv*o|x4Xp|e4NcBi
z_yR>z93+pLUEW$*&aCVKg?ha1jB{f)H}uMBv>^o{)48bVhC=t4S4dk7L_|^1xz!aF
zKudyp+Gs}D<Kg>Dl#zSyx@$y5ul%(-@b4k@F1v{5yBO&yb{~!}@Ye<kjtBSh_o@hO
ztz(~J$?|`H7ZPCD4S3#XnX<wgW0#28g8&ND46T@OJ<H#1?j#x4*t|)%@Q0;!@|5uQ
zZN}}-OzR@y)h8j@x_#e{Z*q#oQ!4;gb$=?`j3@$F?mq#Hcx|hX>LwTxz+WGMj!^;h
zdHQDj8!!<y6ToJF{$ah*iP?V#a94AI-s2mx`p``=;;!xMy~k%yCT{Fq*87nUxB(FO
z&a2MNa#g@jT?07mox8t{Z2mL<-IBjN>HluYf4AhninDHE{*`T7fA!xj`TuWAo=Ztd
z<?Z*+_#ZsiZ(C)Bp63-7o~waWid$^Vy8q2<_yAtx&-l)hzdql8KkhF;j&tW&Bk|w=
z^6RUo>x09GGZmlzWlR3~$*Ye5NBU*OTWRy3IR%U`7f_Yj_dl#P1#qN~!mKwPzwyV_
zZ|jcKNdL({fA_Bo+Aaw=(iCxv|G|;|-?k+H@FcXhntFH?T)NaLQolNvV`mNmWzVR4
ziu;%eZ=7CPPd}eLww|Ze;&{9f3t8L^<FpEd#mdO3TSV=<Qe>3AJI5~fs0_%xZMyOC
z+@|ynkYBwnci`Y4ELbNJn4ATCgET%IuPb#%!$!4Il?+J-=5O5trt;4_zu2*HrgZ%Z
zXV<TA&Hl}PEw|TI0TY=!XDY9GQp)BQ%*@Q(dP?P8+xk_?9uTEHvBc3NKY}69fm+Q7
zH$kPTf7c)1E8<gOr0SY*=+Gg>Kx%SGSR2Bs(g(g@^wFOUC$w%~EWW7b`15O1Tbr4Y
zQQFT3LuI@$=y;TPct>28-PGr8%%0;pG3J!=KC7}}84U$!q2_!19gYCmB13m?$6K&p
z*O^$YJPW&UW7W!FpwmStRcTI}-h;7to*n1(OIG>cZ%^w0BndS6wTM?G*mn#&GU|xZ
zSaqwPJ%eVYRZlLd&`3lc7gbJv;4A9)!}jH?SEOa{#+5pDN5(T(?&Gg=-!ONyG&Bq|
zjMemZidUf2{M}H;jqx9v<<tx~Oqzk-USQ3l<b2*2_Ee-QDla#;7d}$V!?V8RR1H5?
z@E`tg!*B88;qF44a$p-i%!EIBsouzCk9{TOGvqYTQ@|f(72|De2Fg~QaYTx6Xy|Xn
zn;ZSL>&-e`GdDL6S)dCn&dWfmk1_(*#<F=`KPBwkCl3?G3n_)fLKt+lZ)@{tX!-pY
zZPnv$sk~TIGaHEkZ$h2$mGJ{;cZzO&PHX2DHa#!gCbXQNA^Q|#waTk>h)aVG9@V(G
z;+2(^?e^_?{D4y9-s72o?0o<_ABP^VIHxD)r1V=GhAjuA1~skd8yb4c3o)tg7NW{O
zu6}K7jC7H9-JIYtSx>?Xr2HwMW&7b3&mS9eT=}Nd_ghKaVUGddMm*YpA?E*#MGIqP
z7^MZhF-m<@Grz#E<S@!lwr6{GpHpv6rTLDD`cD^KTknYxFb<UG%hn9Zsq&l1-J*8_
z^<<TvQMXep(*RY`0iW#)EiIf`t*_rc5Hye#GJ+0V9Hof64gSpXLUZvb+&7!Lh`*Yv
ze>mN%AJ%s{)+kKh+uOV8rg7I!ao8vbm`Xs5l$Mk0*oW!Q0Mt3>hQP#Fo2t|J!9tI=
zmq!swKrh}Npd!JR+lm<&YZ{)$FvRlDqaH0yVg{U=&qcCwj4pqH4-_xZH7{PgsBfh2
zBmdil8c5eU16nBi3F1q5$I4-);oKX+r#Ds21G%Txb<^A*-4Ly1j9+6`i&zJM-tHIa
zC3x-vgKP_L2^e-6EKvOr14xfngl{(KFg5+do5uY;FyKFGET}$X6z|cAA-}~p+kn<r
z2acn!Sm?v5?AzhGU1HS+Hfn+0r}SR?0QnvzEV4g5q=(<C*eAN0+BEZ8m3u5TjF}a-
zril$19~I$dEtZ*y-P$mn|2M@uEnmaZedy2d^_fpdP0j1=?G@f8D<x}w?_T94h0f%~
zT?vVah};V8d+(1Ms^OWpdJ@s@zQk<L@&^tN`cVi30-k91A+vtFgrp=U*GBI8Ce+b^
z=b;hLErZ2Zy6Sgrx^17<Ph?DTN-o~i+dYj0oSo(E!>OCv=jZ3v%`-BsMik^u-Opfj
zD8BEw-1E+#y*mhcA}Bmom%ril#sc-`4Digbd`p7laLy72koF6*){Bu%O--kr-yXY#
z-3k;+PgWbqM{9B|{Ta9nO76Sg(syp6MYT33r|Y2d6}))_#BVOk;xIXieYmfd3w|En
zY-r&=CZ>My2d4ecP3oracddhaTv?f!g)J;Y6I^t2+s+fYbCNN40|G{~Gj1DO8J?7s
zG>$b)%O=@|>s2$#Uln3kFG)y96tCil^{$(oW~cn@YHt(^4u?xiOLsnhGh_}3qGYzF
z_9Ohov=qZ}F~J|{zcbAw&Yg7`HI0>0QZfg$D*2AU#GXyUllCj?NsNX0dBwGg`2KHW
zxMj12?U&V0Z{H!R)EPbWK1bZb$>|)xz_v&~*~my<JsHARt677}&AsF0RjB(q35Y?k
zgyNdnu+i6gz%sLzmzU4?+#laKY&kFk1W$vSPZnuFBnFJM`;R#MpI^CpcAbju^w6EN
z1Sa?e%^z3W@LmoA73ks-@xswJPS?aX+;eXE=lB0ZQnU*J;TvxAG>d*ctC^pj{AEKi
zJutWRt_T&+nbBLF9U`E4xM~EA3$1)1Co4<z4Ah+FhJNQe?9Y2*3Mh`{*o~rl7^Br8
z!iYb&5cpWWd!kX&#RVN6V`ylo>>fr=&F}LTH(H@*y_Tg2^pB@35pW87<D|+}_dVL4
zL0ZA&3x=?t_o7w9-Wdt2*B%!-BIr8)+_XR4F4#LiM#T56kMF|dBF#M(xB8G<s}`;@
zSpSCX8s+IfH=^P(%kEBisBvjRYqCA<H?0H#<w4kaC0G9cm39BOx8`~QLGq4TcI2zK
z`8A(R4Df3p<JOS76c21<L#%pR>pd&C{5`K;0`>z1hNKUN1q_%ARq-f$*uZ&3z){uQ
z(7~0QDS{R+2e8^eUE47Yw|5P(3)tVEKO0K43-_<<cWaiNI^pGjhr9%AscFLHog1&C
zRtIQPh?v!slWS`oVvDx{K?2SOI*ohfRm1!#>|3oYX?(`$-FO&twO?`#&kh|l5uygt
zT-66SH1`2Q4&fcLF}tNZV&`-g5XPxkr@i^W4rUDmPOVO%NJtDdzu2L%#|1Lkou@`G
z>+)-s#f+!;wz<w>fu!2)#>fpN<z&(BJ=(A!yl<>%8JK44<px-hHUCMZhf!`FTdFJl
z4JU9mf;~QOU?pY-c}%#QVWYOxZK~u+R@7Mj@r3&ujen-`_3?}-v5?#jWnneo=FS78
z?}nx|!tnOV$vXDx=ozy?SYn%~lGoxRSupOpLVEBmov#vVV=eKD4`)9n_hz)O4(#4L
zOZO`Osd?lJ7OfLRTU}_}`1rl6_lI@^>kl6u-0A-9Zj|a=ZSCpQ@M2WGVQwv(Z0aiE
z3v}FE00Id}%{}VVnPI-=o~%23tfxR9$@Z?l^pX5sWOlu{+8xDmu&NxzdRjtz>WlUD
zZ<{p6(213%QGedHzO3TYp(9i|1KziGN3@_u0Dg88n&fl#NuXV%X%P0~89KT4sh*oS
zP>$m7bX;gd&F+vofF8tRf<1mTu|Iu!APSrQK67i=h2(`Vdg&ASQ(Od=IgOY?F_FTo
zn3R+&qR?7x7Kt>bImlb7{c1P)sku;Skkhbo{~#4|!g=QLf7pY6nH&+llWukF=(=Vb
z<+s3Oy@t5aO^$6Yx(K9VRi0g9x%dOR1Ckuwv5EK`1Q46bX=RL?2JpF_(k#b~9eD3D
zU;{;HDeC2q0n;S&q4Vs9o3Lxm6Zl-Xh=$7k^|6uvFDi|P?x+aA2`uzR?aecrtnbA-
z%^Y6a+huP1Hy@HYJ>6pXG||grZv?Q5sq1d!?Ah@bdGQH<H{;RXz%d3JZ{Du5m;Z1}
zP0h_+N~D2L5_X|k5!?26FCT6^@B`B{R5GFD_J!jRpEH3b(e5&AHT;N2g=7>IOxOLB
zt@Fgejc@v7yY{+&diC<<V&CJ)s)@Jiz+yY<Kl)mo-F^0K{Z!{G0&%8#$=uCNdJuNj
zP|jh)O#8__fAdj=g&<egJTMIJGA9(`-6pd-!xrB?moaQ#-X0c3#}My65$KYGg;bie
zZr!@|5(pIzZF%-$;~Rc+{%^6NIh=nM=tArdXFAK|IDFC68{T7i6*A&|p}^SKIFR>;
zPP^|vYXSPw9UL5XGtLB(k8gai*WFVGn1k5XxX4ApACzZkrk##XBwJl?nBVdaB)N<1
zgl39=fejN>&ukbrofO`F`g9FzYbYBpL@u4w6c)2vvFHW6Kz5G!d~%>3m)LNB-^c;Q
zK(I{XBSV|^Z9NwQq<8$iyY9=4cLGSyp92Kb{?c8)!yDUn0B(l>l9=IKczlz|uK*qK
z4j3dG^<BHeaAPF_x@pFN$(pfgl}?!(i!%^9*q;U>fOCg+R5lMz^?=|sWHjl`hF*U?
z`gr;RP_B2kk8Dz#0o>t#H{_Q%@V^`K|ILOx;Ii<J#E}ul{DS<KX?GP&HdBo)+m)|H
zRP<T`=34rkygaJv(<dJrA%x18!cK|Jzw_zZ$%cKGG&PMb0+{10v*Y)%*X#3bf4P^x
zzdh-({Q(gE>|)e8RgItD(3AjLc~ucmV!gTx3c8zI=C_C<pnX#SG4ZK%Qzh;IA_MV#
zr7g!cRpMHGK#2>oU$t$j#M(~)C01;?<glTsTo1u^$pBWZC`nH3*Y@6j8My=d0ISyV
zd-MOWDFuL4t8=RwzwqA;`CC|f^1mDMp9=Kf4fzG`{GYZVG9~I@6O;V;mp&@r>Yr{0
z458=ZmYvK~nsT;MQr|_e0{sX6^NIfJex5hYhLPh-;mOHkPT|e6Rj#uiwuoHWy?&w?
zHDv4tk6?U4;ri~~-XY7y$6G_(su&fiI4(2loL%Ws57?#Me&-ZhJgftO!kdoyyShq|
zA1t(%4U~gjU$s^%=g~i3+-du}SIZ;E%p8)-(2%i^%a<_&6&KbY9Htq=b|Bdg|29Q&
zH8Xr1#gh$8jJZ5|Gc|a%;;rK0ZY7m|ACxV0$cEIwq<A8CGO$v)%!*BtNe5hBTs3>f
z8Zy!}#`EU1#?TCE^~9>X9QCu;XsP@J?w0AAR{B!?HvQZB?HzT-UT+r$qr@_UQMiF&
z_x+O?OkvepD3&wRST(vz5y5)R9_09wr7~1@{cyKCc6szO4M+!nB|`}VZYg0a=9uxi
zSRs!`3|~UhhmU&VJuc~!YW8%p^?Ig*huR^arVV5rbfQh8!~&Cie0>K905-30(b?Eh
z95}TebBa+ZzP%70*01#_&tvvYfqadY{qUVswZR}B8pu5f|33ayjk4!l4UZFxSDYDM
z;Lv-PIsxZ#oojA?Y@-Vwlz24YPnuX6OD8E1u4Kq!`b+LPu$M@7N}<b-_8q^ZZDH-L
zQ(73!jNi>jK1g+T%AVpz<;Y}Lk$L?!tS_NRYc!e1a(H%PhUe>l`*i?0%pJxaFy^Ks
z?<FHJG|o33kd&a?WGou8Qp-tyaM_Te`LJ(4ZV*4-0GpecjX#MM90%m0aBi9!Oi`K~
z@XZNHA6u<urv~(bSTxuZo|+8FmwYb~7}(&`m-6`W>5<VDeHEg=-(;`t+}zwLHcLuU
z(t;Mss@p*;+10mi(&d}}0Xl}@r8fHq)=@rky7WP~@y(l$oWmCeVngP#NY*cMGj<Ae
z|2VV1L!ALD03L0|<J#+~-jkL~<2aamK=D^k%G%MRNAnySnIdKOS?Of7XU6>e%N=8v
zPo1KsnvxERhyVxQsJpe2PaG9WtT2s>k6TYcS5#C8vZ^bE$iBWSL`)TAoBwosVP&GP
z=3iW;_VcSoMln0~9y`hZ(=MFjzckU6bL$MaCaAc&ZEJY7oVt4TEs}SfF_0euhI>>8
zcq#{Z71l77u>j*UGiFom*SXlpaGUL0=l=Ygj!!i&T6_0ZPKLMRM66A#J=(Sf(sD%u
zdmF;3$&m2e^@)=_R+o|HwMKE3Oez#8DHSDS5OcNmGrsX0ky1@otxVMdRnJBpO+dJh
zV6hd;Gwk%GW>on3bGqvsSRa4H=R3ZA^KjtI6Ze6jW-OPRdMPX+V5T^O%?_Y=WGyb5
z5p9FD#%H-RRYzqk)G4Xe5R@#Yx1jB!)w@+rtkx8U#%*sRx)ag9dY<T!QF2%{a?ReG
z&W~gO+(bqghi*(_?H46aWK}|3zIQ_U^Zbc5Kn|L*xPZdDw<ev)ItzZ6l;vfk?heel
zJbxx*l)7b~#;%Aq|5VnuZ5XdRpj=g+OJCYPo9Y0Q08n;yi@wT0D1{T^OWpgm_r6N)
zMQ$1YL;2K#?#}dZ*{*kUW0PN?kN{s38ylqk8Dr8G_DnX1HDDmBUT*r}!DIEtGzE6S
z(ge}w{rlr0A9F;gpUUm%3Le~oG7y~r4Gyl{FM36nS2@931P;<!(K7Jg_kd&*GP$55
zG9zn0mYtnBo;4<B@dGbU1#BX;;F*~Jy9GCTo#vUwXiZa7u}Yg{NKY9@$*S78?AN)C
zzikbVz3RIy^fCL#*o#@s+jVU6i02N`up&9N@CR69ZMqt-oZQE5_#6(wU55ouOcbKk
z*vy}wW9;?B3;X0-7BI(;QNhcrwJ8?<jT*QQc;>~hes5vlwcq>p{A7!z<i97h<Y6Fz
z{UPwx#hJTjYEX<}-?kH|&k&W~V1A+SJoiF;mz})UtQG$c)Ea4>1RWDLY)fTjdtqTF
zPtrepp4F6>w@b7MF1^r=WK?i^5M=<dX1HnwGB?lr^r<tIz4A$-YWgL3@ux!U%C>u8
zxajR~UdcS})X!2hkXY;oW_gLoSRlO-l`1_4j{&p2c+0-;tNiK14NF}F{KW7JAy=lU
zK$XzR0LzoywG@k`-X|E(0=XV&Iynq&?4ch-!w}l`wH2%Oj(v;y-sMy&WR4jaW>3Du
z+7(020|n0IhUIOl3uiI!OR-m~*to_4r#3yY4m>dxu&$}^ME;fj`iC_<0NQG}Z+7?0
z4Fx1%UxlfO2?>+WPYtaZf4RnCc9<uoTQE%T0#hl?mjn~Y_Se`I9d$N;UJmLFI(k&7
zI^7OB!Y6lSF$NeLh*qI?0o+~J57VGIKIif0Hw5;$20>Ip-6pYIILCHZ{~bM#qYI_R
zh9)K^aq6BEoe=*vJ`3g5-2kfxsb09&`kt-(gw(&1jv!WBuyiR%SncD;|A)Kx3~I9L
z+J<fDrBShhihv#IA_4+ZtSAUb@1Rs6K%|!tA|j$9pwg5U5$U}ofi$E`?=>U=5kgBs
z3jspNdvZPZJ@d_@zQ4X-?>K{_j{DqY?Y-At$FYuOGgYI-Eij=zB#v6_K-mWOmw7R(
z9K<d6o`eRJ)K3zQcNP&A3dupUJ7Fcu7H(y2e5G+C=c83L6E-N3=Iaw^;0>eicrW)-
z@^#IoroD-(;{pE$kdXjFYpALD))=VpWZi#3M8rj%yVJY%eQj(ioxQsnh;3(@SVJ{H
zs$5&E%6L=Ok_7~3nWE&IE%OeDN0OGl+rw5DsG3^Z{fEN^^U;*G`zV<bfT+AEO||kz
zx>t^QvfRQoL^_@&-6JaS4cj|aCMa~Y1`nw~S7eEeW3da3*jb7EP4CTf1AD+74Ns-R
zQ~@<6asb0XFlbbD%Y`V6?ZxqDRs^{Jp#5xtJi8cZ4dYk=&{hVD=&N<$#;<J$gs!Q}
zM`1Qx&rg3(2UJVlVbC>c=ciG$Z(D)!uk~6E6Gc0C*&9gbq=Kam>nc4|+<7qxiIK<Y
zG$JFQF0Oa2@ubLFQZeL)rEk49W}Uk^O=#-+)G|08-Gv(<_Y)aG`CD4h>G`?jD^Y4a
zSG>=kJ?rfE*zft<9WP$Kj(z*-%wyX}w%hjY+ovi1<&4;5$M-LHs?~4aIV?Jz7)1$G
zNS$3C5uGHDVFwa<MxeHc4%J%Wjv*?EMzksrm#+HWhGW2WA$V>V)f`QimUHfYgl5hB
zBtI;1<UKao&V956Rf`!(Q0YBnlJaq)#nFIG9{b<wG93C5qwc<4wHlUs-D_mEn3tj5
zSVMZ(1}esPP+R?*;ue1lzRh!u;@=&}neJW)By}TUsL&J{T-DD~P*C;88<ErL)YQPb
zxai7CYIPW-?N?kvs(xc34A!^|kQ$hfh>qchkHLILYy#HS093gj%7D*+xU>@toZJJD
z>PBl^ddVrOb=hdg%nOS$9xqALhk#C=s@lq@%v|$~j|}Z?5Q+uV*LQoNoVcL<#g{nW
z6|=0|2jj2I%l!i|OBt~FD^p{K&2h`h6xFPhz!$_u%`wweoKuGoD}|p7y=a3IoU3lk
z$vVvt@*RA)QDA|_KI7!1@vb^zs1qjFu#f%5OthA#j&@)?kRKnEQGz-myLum_FAu!Z
zc6WQhrqeSnMV^{sscn8dUR!c#xMo3_9$>mMU#EGbFWb7FC(o_{pBYegsiIJYy&)b*
zB}My8PK(UW<Vp3@@$73W^-V5bq&RvI)|b}B6bzguD?^)u$bsygtd%;jv|9T4+5Yxr
z<L`F2?^Pc1Q?DYHJ9VhyRiOk>j|!_?wj%x9dF0b3PgZ}!%aU3vH+WK*>TH`Ivk_3_
zB4Yz{g4V7Uy2iA%OIx7ciSKn7zv8}ejO1sc%U@2cP?L3eaqirCACg?cOod(I?5~(8
zBOP}=y$_{kOkc)u(nV_db!~C@#$AKVj;<eRyffd9MmKd!+pP&n<KPqZS=|SaaR3qA
ziq}Lw>v9bg8v50(k?6BxCgK#>GZ~{>)&2f(hq&9x{OO{OzAaN%$c*%vz?WhXHxhQr
zc;uR}{y~C!G&SU|>yI5Clft1X6H$VNJ`Q<vs-|pqAYPTmbNBAOX^cSN%%WC@pPB`C
zXj1d(5LbgI!0Uo^m744CVTN$)GuUm2QNpvv7xQG@4)uKux9uZ)k7i}%C8%V>g{^#>
z0*0)$8|KL`Nd2_HRTOtV#d-Z#k2Ea9UWzb(nu(dXhh%g&q9gh1%r6u3I@BptI}Md-
z3)9{mHRWYYCv9Qst-%9uh-XOEz$+CGcxJtUY(Ea&eWrhN%?XML_P_YzYW%^{(aol6
z4oMYo9$hFIMbfX)^+9gNWju6#tFGz+UUpD#PblnWdYjAUDjY;&S^FbAGJ}hRQoQZ3
z;0>IYCq)7~zlkF7X1kMy14lPQ?H;FP$9+91WB)!W4bI?1W3Q-;D{b?onOJ(oSo_oW
zQfhaBFtV>$5&ZD1&jzVLcB#_Fw1;~p+u*iPCl;jI6>&6knp9b&Bmmjp5GnL^vh7p`
zHXA5qirL0WRfbL_#wTDHzCdkblpv(-Dh@q7O_s|lsOHYZnyou9&HaMG6e;daj_`?(
zg=CD%g~8GZVf2quG(9wKPiZ)xbxRX%*+AEOjN{QL-}5~fjkUt9vuQ+>H}Brk#g^-D
zD+|mXeHz2B`MFZev3`s`t}1t!gm7-`pG}f<g&NHkYGR{aamYl0<13DlYEr1@g*+VV
zdAf@CG@Ma@nOOvpa)7dDMc`pyKi()Q{M2c`q705IOF32Yx47Du3;);yNM538GU}N|
z{FVv)JjlQwx$NPwcbYE=NhkWrS_>3RO|?P}`6ndE;Di?kIa1HjXUK_RAwWU<66p$|
zXB4+REyebS0S%Zb3zh5s-*nwOIWWT+%ExQ+%7Ha?Ckc#(8%v)+nxG?OVl{54dxgcv
zjaMoSb0zwzp7?HF7HsLe0O!4e8=6S{(5A$C;Rr#zi<oyjPA2BBmqX6@H!4rRoOB`Q
zm$a*}mv{7i>=47Tgsz(I{XC3}dPdUL*6#Y~AU@*iFYa`8wTWu!EC4EW6MXKd&HHL*
z^A$_kZ*Ea#u9)N49%w<4u%>Iy2C+E07|7_+#Fd$+=rarxibPLsv`WDmM8~ia-ZJC=
zYUN%SPpv$Nll_VrH2#Fw&YeEe5ZBgZs!T%6Z?*-1mTMwnNW|^dY;f&8ep{k#A&{fh
zo^%wJ5$x%O#Y|kJTVn{!<1RhxVib>pSe>QJ$Ua)8Z*VwEmh5kFK3p)Ua}@dV<ptKg
zJ5OG*$S($04z=>Jk!L6tEoVqg7gd;ZTEk^dMdCSjv*xBYnL4F1`C~%n4t{C@Qv5dl
zz8D36oJU#sMbshWz#KQm%RE`i;xdsgz)nH$c_ME|2?o?14*y=-Op~BKyp2+bvc?Cl
z|BBHyEU~Ts2ww;v-N(zGCu^21S0cfeX1K8RxXD(lQ8uokmYq!J$<u~x_tcThn<qOe
z>3-hKB(~kEP?*F~lX6tOnnC*x>}|S=>u~G$7!LN2=;FJEgU@$mSr)stHMH(<w77xl
zAn~s0I63I%Cr1ugCn;&gWC`L_!3c>@W6kZRqI^XvEA#k50%o8TICeaSEZC}}(9REW
zWnuAX=3H`-{#i3XhRK2_!8$0l{W`7AJIl4ZBE)qC!_y~jyqW*Gj0zq?i^IVDs{-W4
z`UbWmleoA070WnvVj(TvD(5&Th((XkE3#0U$`!vV{n2H@Gyh>U|1vZM`5s4NN-hbK
zp=tA>JJ&P4kQlmgsOmUzm#;N^B;O{*9oMc9GqTd6>#xQxU|r)NWu_Y%nkOy$bG_1D
zu}*@?)Mco9gaT3E<dS36S2HiNPsHdjLo?V4Ae__;9;R1^49ry{;)tcgtp5CWJ;?ze
zOVLa05x(k7SDh&C#iie1u#5M;gXU>3{-J~XOt;n}sXpaH-wVaOA{tU1$db*Rwes`!
zWB&9412baX>BJt+w+7AR_bGjS1-d93pSR$c(~-grX?O>dLmOZiZvBvyVL8x^rOlGF
z9cwOt_&SF%+Ybm;u-NM#N{)4i7q#~;4^Y<#=p&MVFtQJa7NH@GYvif6ZUNLx7${fL
zBz+Hr&)b+^ZFyn4((F5~;~O^5g*D9|_Ljx{4f!`Y=N))Yc!D8SOKEv$xz!sv?mgm#
z)8`n~Z#c?%rHYDxo=ArkOC>juIh*T~*V6kXnB-b(%1{k>I+{}Ynb;37MSa%#Qb30C
zjd@mT3mG5G$m77seCZ=2p1h2sSJxbtrQ3PHUKswln>|cHcOPDJz<e|m{G4Z@qaTI&
zrE$7!sO@Y>xht&9;>Hkp^*#~D^Q}y5HioFu%KB4CWg0-ixsuf%7aIO42Xu-w2h>WV
zW*x)!O&FHlld~!CguBn=*RWStL(e)i_*%`1`%v8!oCE*^$wec0UNWQdlN=P<RcDWx
zAXLU%+4(Q%b3ig%NZCFHewavp!<g%7le{&9EN2hSEr=e~a0aTtOamoY1oi*|;NT&^
zidk${<J3SO7^oAkBx$~w61*OOgiw-{kUkD3i^HXP0SunS{zg!{vX(EsuZmL`(GE$Y
zDf?C~l<YbA;6YO<+o#=vF<qe0ATB1Rsp5{e5jjn<M01p70|8e{wh!2Zlbj4m<;u@X
zz6ZraZ5<49jSG?|CYX5E;USK9V}TWk;~dc;wK`h11LzHg=fKQ>Ue-#1QI)k|ffXyf
zruN*303Xm%#Y!{hoRJzR_WQeFRJQvtU-lTD*+stonbj^rmrN{oh*})~8OB;+dx4|d
zl{PEVnSf8;LLM$*N;D^ki(}C`YP36d6Qm~i?gfv2IP9+dqTIoEab3B3<xi_}1jyTZ
z$&yx4d#Igst(B#c1Qb)=Be2?e#Y98JP2g%pm3gv{3u+A3;3+p?3Hu!A$H<=Qo(9t`
zat?}n*t!iAs$dAWr76x=`xDX9i-0J#s{GDD#~l`B&sYF)_0dpiSK$qv;gc)I#y^@t
z4uI{FuNId|XedDDUU0_FH##qLGe#D0JYX6F9Bh%*94DTmU%yBI53hH~`%HO;GZH1H
zR``b6TGRuW6KcT_O!uq0Nd>R|AnhQU4`oc^4s5ehq};j3SY^GgjDWr<@t83(7MS9(
zUVTK_y4Y=dVO&_QWsYs(7-zO@a(1?!g1IU#9~wA%yVhq^{aqfl3PyG3-|dH;-i=;$
zZa_IN8LP;6m*;Qd<??DFv!L?p<FVcjUN{9A99XC7G0nBWy3Dv1ar&3?hA`Z{vnRa)
zd*p$&tX)|<z&~#)xV7dfg#*SDXcaKTL$J$~Op1xKAp*RVXu#X|hnz*J9MU9GQ$Nl9
zmkW?T@?K@x-*L58Y3-XG%*H{XfxMfq0$%mg37zdZ>}Y41;dyZ=R1}`X`ZD(wWL{AZ
z#>a2%Jv3z?L8Q&Q3cLbUE#}e+4HG!*cBoJv1D@}fRl+XoGfJ3xC10>XlOq0!UuF;J
z&%!^2vrba36tnA+3X-gbPUp>%3Jrv9U_lIW>HJ7@#_88@3~X<`XpVj3Tjo^|AcyWD
zhod?Rk^HI9k+}XQU4Mui+l{YyK*ID!sk@}j>p57e@Aj^8*+s8)L^Y7hd#tJ6g#3wq
zdWDyf7Q(8B`LXo##HFQ{xvp~|p_1J$kSl|sZ_3@Mg(R_~R>N(mj=_8ibY;$<{_Vt)
zC49s&6+!xW&BV7p&uX)a%jdGZ6tldNY|^b_e;;ZMRX%g>oF(A&hs``Lo42$5X;^4!
z78WiXbSBoKrAZPEqp@GCu6b?z9KKW~g+i!|mhL%oa(0M8tg_LJ6A(W2TkH{lEXM%I
zQg{+Dbj*VMPS{+w2#FMD<qx6Yv7<*-WY;H7Gj4&X)V9P?;w9SGGH1UakJdwS;Ni<Q
zfQD5)dYMj53Q08zZ@<B@KLE9T&d6h!Y<z?6x$$8Z@*a4wfxb_chg!|%jcerUXN2-z
zcu_eN8ZWOv&ZJvGI{PH0JrZnhu6Ws5_a{&!21XPbsB2HuuRuHf{)nHxy**mIpMhm!
zbm4_uVgMWan1&lFsyLZ-k_Zs>$1Uo5EvDqMLRwG6TbO~wAs<R$%(km48-qQBXpp(Q
z2o{VQDhHlO^?pL)MYgg71rx`}M4;N`LS$;N`>o8AQ{*{TgZ8NzGC?J%5mj$%<3BAY
z$@X=?v<PyR9}B`Qm%M>obkh6`lGxzv)PnG@kqM;dXaqGDn^lcB==K3olGLUW4YWXC
z8maGd|DG$9C%Tc^1Acj3csr^)C3KrKE;=%@$BMHX4Ae3HT-c}MKhxBhXTs8P8OaXz
z*f_}Fr05opU;FeRr#qwEcA}$n&#~LPSv@iu3ZfsqJRkjWP7bZ=ZcR$%_I)Og8>6g-
zOMQ~goj-3>=4ccrp5!&XKd%YzMRkvpw$VXGWv4ncC2TBrI=+LDOSOSFtZ`dnpCM9n
z;<VFiVrWDG*VPX>1Qyn-E&3>IEY?`aQh%6#uBMi>qtHyHw@H_~(@hwfH%2uA$9_!w
z=`tzYSDZ?@2;M<6pW^+4Wo_G0eF;FaUC-Zx{}svB!~r<<8(~|izoAU(X9fX`In=Fg
zO8SqV0FHL`H$Zlg^up~{p1;E3yOMy<6i1%m{5fwQK)5b10C391;MbMvf1YK4e)IS!
zfZU@Fr&s;yI{EkSE?NUI`Z``2{=X(m9dZReQ!Q`1{5Ksi^)Gcm!DFCE?BtHWPTC7?
z0Kpl&_ippA<BjzP!2Kg?b(UxTI%&mQnP0@$T{eFm?-6Nrf197-pFn@-5Ns)PJr<Bz
z|NU|QpE-K;6L5aCHV%1({B_d)e=-uyhyGPhn-(9JW&M49?w)xDB>Wt!*5jp})dHA*
zPlvAmwV3m^9e06jG8=Ey>EA04|Mw{y60|oqdtOyeuJ5crd{XOW%76diH^}sb&KZEL
z#~fnIPD!1)9j<l9AMymxiuw5QCmUMKdyw-tt*S#mtiJDnviBZ1-~$g-t7M$4u-FCj
zXN0XZH8p8!YJTK6tC6W8TDl#7{qjDsQ6A=#Cr?Td^YhPGPQ`mxZwivL4$zMtJsO8`
zjQr}@VLZd4Xzkt0Bj~mA*KYi?JLJdxuw?I#KZ!_#`!Sc^zJC4B`Zl$xTBvwT%=`CW
zV*B!ruYKRSZ?^kx8Z|{EPVD%8^fB094d-&Ux@EFHpOoQZZ;s{(CBroBBrza=&E#Iz
zmvHGQPN*slt*;0~WW?lLKi!H}F-}XcGCm!Z{8xJ2mrp$Us_XYf)i~cOZiXH^etbf6
zYS-)z6fjg`J`^aDW@mRCHXixbf6c*hgnvnTPuAZ?`d0gll+GI!sF>sA!#F9cVc<FO
z+U*MJ3ooOfAJ8gv7)BY@2|#v@pXhY@>&Cft<i0D#de3C5#~8kkAcB*=Fo-+d;7GRc
z7e0D4y_7b5m`vq~cKgfz4moo9@fc@wsO-3)ptiq_<@hYbA92Iut3JW>a(&}*6O+(c
zoL<JUz|DYtvt*Tub#2I>8yYR%O1gY*@f|Tw=3xoLj%~vqAV>}VtlG6&t>C`=M?gHJ
z7APLCy6qkXF|WFiS=d_9!7#lWr(YM_v_?we{KdvXZc71P)sH4wL}$@F0mj}o<vi~j
za`$<t-`v!n#TCNSf#Z1FJEbvL7w-<>hk)1aKTqc68^8fmQ`XA*0Ay%rQ&~|jS-}P+
zXa9Vt?Rvh|>i(?;{~vCZXD{RE(U@zn&G1~kjE{x5FLzN?%hI1t9HeuZj@sCXzC74V
z3XHv)mobd@D}u0_kBiUz<jY#e!@od2#U|$$cOD9R`Eqxl$+Ykvr*ZpMiH2>rJphV4
zu$ae#>6Kh7k6SN3D!4xSncdahFG*ke(UpEY@Xq9@;&e|(?6ozyxWpSnZu|oimqb<D
z{qj4P+6{gQ`q}4vz79p58%DM)Vq>eg#@)DpA-cc-z@`3VI;tmj-=8~CdOYw~<z5VO
zoasWD`RK~Nx{)Ee{%p)vWrW3N<sHu*gQ7Qer#d2&V2vsmy`7OT96Y3O4IzkKUKr5w
zS?tp8#p#9a5ERc!VbRsTglU=BS3a25*Q1}U3loG43^uZ-r|uny$QKR?9%WUT0`YM7
zujg}(7V`3%nnX)sIOCEavp$utftlgAY^1q2u`6?0eyx{)u)%}c^UPTWfOpH^6cHv~
z>rpHtb~JdktfZK&EWDhIG!zrl*D}s;UWT=RI)0A5vpL^#@Aup7ITyI;H!Y42#fOXG
zqEE}-8xu)>zow+Ge~g$Ot`Fy0Wl-QYXS=#SqaK(OEcb>A8!Rg?k^E!^EYH)1#)(q-
zFz8)UFf{(&ULZ^Bhp~y%n$-*eruj)pjtH}p!rma=ez9@z*3BCB9z?Jnz;{TWd?%PG
z7AIy;4BL3c;<{3D>b}_*5R1E1E?j;$AKb-Kn-2Lf-karRfyB>z-6);FP$u1!uX*%W
zLv07>_;ot953@SgGg2iU8)-}_r14_sRYgS~93_7$A}U)kmcT<CYn5PK=@d`bGD~f@
z(ACvlR$Vmr6j<|K;2on0hiq!(^>3!h>M9v?0=*YW;V_|-Id#7-2%6<(GAgKu;E(Mp
zv^#huww2q4Q<Bh3kL1?8LRwIQ=A1?wclKQhCp*z7FT45!as<ejT(ulRG6j?xfQMm-
za797ht=n4dNyle5hqLA2uARrJi0J|Ul0Q)99~}dx{cc)fqn%LhysB;MiMz?qUVKEk
zc5POA9Usd7{8bv)$&~jPyLC}@qZshVt#EfdTH@CVFU(O9#|Rz<g<~)m+poS=*EZEc
zV(stdn`iuzZGVO^s#tRry=GVv!6!PFVDrt5XqaoM$WL}cLV7JA6MC|<ZA$`V#voF|
zjlJJ9ZMt~VOfC67kgr-6rST4t%S$kgrL{sK*g2`EObqZV?Jy9LRTN}|O7ns1Rz-n7
zR5IHTH%-@O%}JcqvUS&n3hyMg@)F?-?1wY=cEB8BAirm-3G%e&{Y}+9Q0&hTqPy|<
zD<2qQqE`gKcieuR&oyB`zETxD&c{;Eya_-Niv%)V7Bp56YmgVw-hS;)Wf*ISMirb&
z713xC+Eq@N3!;=HaF_F--<QdCPMpe%8<_r)gNB_YW#d#Px%jHto`ZF{1Ca%?KGNt-
z`wdkz%?le$`0d&ZsWsWUF&Z`>g|ptMZG5Rvg~i4u=IZOJrFT1}rp2ZxANM2q5av}K
z=dNF@Qtin)%6H_PQT8XOzpy|aC&4OSr*8%6WhTz5;)-6ls=w#e0fWUCJV10;?@su^
zJ+<uo70GWyxU~ZeC+XEY<C*x3MmjxbNk>hT<YT6;YPY#(xOh!C#do6%U}$x}H3DA+
zWO_mHh7De3Z4ub0BuFvEYi404xE4@Sc1}_Q5+f^O9IMhHz$1_rXxWqATgE{u<ys4}
zAhQgh1lPAni_I=n3YMhkVw^Xp+?E|q*E2Ny#`be>Y@RK;r!xjaqY9S$7UPC19Fp2q
zC;WXX*00LtL!aG4^ZRmF8h7^<!Cunm`mIF-Nf&yi)z&@VxH|f~xa2xYt|Fuq*@h%9
zt;W+Vity1qsz^t-38m1`{?1D!Yp<N8$|@5lqdZGJE4E5u*6tM}T4LYGS}+HOPffX2
z%a4OlDlIy+6Q{|zD=kt3Rynf(VC=>wVh$v(udqwiv9^_^N(-MZVHR;^*G6+n-oA-6
zD3~$wv8N@{)1rCCe02mOa=g?!`Lzgs5OY(}6sdxuR>R>-Ky<wfV>jQEczxrh+>KIS
z^>7wx&wf2DfOiTog6EoV2~zSutTX4nVKjQ51tX-_+Bw#P6&4S^L=9MuB~7c&^nF%Z
zn96LQUaD^)F=9DU_$v;m_(IDJ5|mZhZHV@BP8T~aUI7j0%`2KMKN{6P$J)$#S$79X
zSPnv7U%QUK;)4<}fu8>rFJE9dODSo0ccpClrzsnIPwTr|7Ga9Rl&qk4qgbD<W>XX>
zUx2_$5u$&iaG>!<4j#&Dk5OA^PTdbk!)-R!{1)Xq-2fZ~+pnyKE8%q4$M#%Yrp*@K
z_~zvlM<43pp_Z6fj)52k@(}&z$xxqp1LGpSZY^oe3GrX2$l@38J`mr`3rW2mSgz0A
z=*hBNACI>37gn%+sm~|z48hi<|0;#td?i*j#?fXS=#L^n<yaYqr8bzuM1(|d_JblU
zJk{f;%rM3+tH>QToXA>ITk8(1>d)WRtfuUTDek^ClMt@<Wxn_dMaBy#ZdPT@d(ew$
zamYn(f>!+;c`{vS;Ba4_OM|ko^H8(V`Vyl}YP9@0#<y*T;I*Ft$ATCfMPqBc*FJ{i
z55m&qipwMFKibKhsE-EvmWm02SXMTT7CI8RgCBYQt}qN~=*1V5i?%);FZwH))y02`
zGb~Ve;b8)}$gu5{k>&lQo=y4C^%&`d89H4d*U<jurS?FLmSEEi(T*E4nl+aFOr4Ar
zlKa5pGNPMfW!onL=fj7>3)%y-h286I79_u(R9I^mhi@>|Z~cvn*Tmh@GlRHj@bG<M
zSf!~Knfp-sMt_G&@>PgHw31w&^H6lvR1?3o5AUAlxX6A8-2G7~25DG%Yt4HE2m+%%
z#En)`<5w`h=41io(ekkmO5=5QFt#u$o6sC583P_lo?BTu7)xq}iYLi#Y^oBL;-m#q
zCNTR}8p6UB{d{J>Xil_LE^5lt$pqsVcn9HxoSUhxmdWN^LqA)kY>0#Ef2kr-xiKPZ
zgw*G`d+$|?(5InO2Yney<BD0Sqy1^CFb-u#=4rOn^`&E^k<1JfZ7^fA7U9QhNoSDi
zIfNm`lks(*zOq`RVw4+GEN*%3+h^bgG$#Qxj@R>7XhZNbjqKLKzV<#mM^1^enr>9!
z$-_KxU80Bcgctnu51vBRmZzY3e9X80BpF&A;BxDQtu+2xOCn3u0xd>=C9nZv$X>5M
zc;ZWMeFO|Kd4f#cGQKlvV;pHP_t{uMSec)<^Q<yn@=~C7QLwu&Gu@Bb$>WqPAyB&~
zHMlEm+S(sdMku0tAc%|%kv$dfyNB)4ZGgKee5K0DDP`GaD$&B9;x{krZp@&i5Gzi$
z_2a_-5iBGa;vu;90ga>-H6J>AD88+!rDVgWLlnp88Z-C7OnUlV#_m?;X7$)~Zg624
z1CzL{uILe34WNT?!AJP|9Xla>2j1vCDqxJWvG=^yb($4ihb=52?iFut<sC)bBnk(6
zq!j|gz#K^Gg?*0+Tn|xp2q{FSjaz$#l(f|aPkml^8yVq6N2%uzs9G%-Si@Q4TTy97
ze?D6aFMO&Hi}mTupr#g1>1UMwY7@nwkK8DbQq^!Ptmq75u@9bpRB&n!<#cg>-fggg
zxEi`taq9{c$(kn%nFh28seZ$=a2=AJgn}L)Oxi>S{X8S2>&1hP%6SqP%c27zeyC5&
za}hcE!lqO*dOn!gZWXxjX8Y%$IaUYxyFaU^Xt|M+G*S!1^#DxBk=G>3ZTLGr<q2)P
zD1L_Nr`lh4m{$y40(0-)A15kE6Hl_Ma#AEY`4$KkRgS2fm^b%jX~ger5C7dH)cLlK
zu4fj<ocx8!+~B(?mz-D*`}ja<20-wg-()MzH;L$o1hL%X%(4ANz;JfB3M|_cFiP``
zAIQk4P9)c`M^+?%Jem*z_zr@=ZI{uYrg+8bIyl2diNekn&-;K{@oV4#<F63cVT&@_
zFcPIWAWz)c3rd~sqvvV`A*euTbpKKdmOOz%^0;YnEY=-u9=-$JmF@op7(mDD{}_TW
zb6!O$Ex^w2vh;N%Q0IAo3Z7IJo*uk39U7RV?RGX`*l~=*uT?eR#Y>{G{cBo*HvoLt
zqmA^nh;N&M^2}&xj0$@t&xgS-JHV*o1|Wq3eR05ja7cDOr{wdx?_!CzgTwQ=vDSBJ
zHE-TWQTax-c$LQkpA7sVu;M-c7*O$y=F2`$eR41;=V<|5MolS*L34W^p+rhM%W?O*
z_+$r=r^_=eZ%lUe0+FPr0bHfJwLCz03T`88X_6kCa(-lI0smHrRr?eM0GgYKt<a(Z
zN`;v`c?ETgqlC1d)f?Q=t$P4h%TI=1W%7iD30huf6*eOJGN{RP=(8o}qVTog28+bS
z)=|qwc{_hZ56qF3V>O$tLGRn!c4}=siNqOWFpmBSj@Vja-eV^I!k)iAh{*-xZhcLU
zD|b&hg7INPs)tL)W7iw1ORp4~wL#UICo2|}6NHnW(1_BJ9#La3DK?*dHUK+W_y=-m
zJB{$37x7AqW8PUSHBRjL@th8}CdD352jRoSohWf+qGVAK7Ri&WR(1v8whz%BKXr4k
zJ9nNdK4yn7Yhw#o2qurY0`(|++JjaIEnADr@~a*$ALEQf^I<&2mPBsQKvreS2*A05
zl55P1@XRr)A{|mzM7#OjfhuHqWoTyBqRl@k0OIgUiq@?_vN&w)`*a=0Yw6EuJBGOS
z^Q_76B`lu+e~|*2eW#3nLl+V$P*_yOK1=+}a*lrDGZ-EPHIkIR(a4l>YmvgifxX3S
z74MOA8o6RJtI}Bu1)9O4eBf^05F^}Dv+O!_iI220f4}Vn^JNr3+%i!Wb@PYt=FCMN
zDLQaUQAaM<xZ6qr?FVtjUGa(99Im)%<&W?!vF9fvps&oW{GZ7HR}0MD4m<|)p6(_n
z?DNESc$&v5j&sHe6oK_R{`-1;9~0kt8Qa0LfwI_Ih{V`mE*(%e#%T3E?pztSdGf-=
zN;h2m>Kaw^lybYtlJ%Q6?qiR@4{U;SfZ!PEYgxbk_|NW~25T5H_Wh`83y?*x^Pe?@
zW1d!~`Uihq_r+JE)pPuULF0v(2_cp)1XU0@_WZCN=~k)r&}s2Ko}>a6mUiie;{8a0
zex}t6H{rx5GS+!XWO~$|k$0PDk#`SGcqzW+o}#FErv_CA9|_RMMr~-1WGOg;=I9!r
z7+*zS+si<^5_6*b)V?MaR%s4cdKT8)sx4pXIG}`@*8A+3?sS|C*>r+Nv8z@lq2`<8
zMKhGV^sicR{VxZom5ZW$WMWMYix+;=2W(^lWSo<}W}OGHk9eB0r9T3QFQo1a&vh?2
zg{gECM{g^LbIP$Sc>zi`*<4IY6g0BY18~_cbLgX`$%tBJ$BGq(Hg-5s*7sA=$yAgX
zynqf(N$hjj&Z+IteuP)j$kwIGPotJ<prA6aao$(B?_6&UKz1EUU<djx@^k}TsXd+a
zgf54L=SxJ!wV7dqL+ON!PzLt({69t#HvM6nz<KYM41jz|$JHjLHF}r|<37U)d{2o2
zye!|@?B=)@@JO!$(vQ16@^r6B1cCcNmvH4l4+7eny5FVQg5gZpu=$o0fRMqVnL_5t
zK{$(1)&Pau%Q<h|DHAC$DGq?&u5M%04t{tMRfs?=@cBT5#T)q}NSu;@Szk%clQ@8B
z2Nbyc-$(qf3tP6tYCH>KXhiDQJrLpe)r*R14xx3SnGcPA&6(}nySJ%y5>I<y9#nZm
z2xi#DAS6AIn8q?<mze`%Ovbs2lM1gZ=R8F>AAezh7~uzvn!|-L9k+-mCYbVKzmYW{
zGwtK{#K1zmhwp3aU~1wOZ3cWZl0E3?0~yAU`aIF`zSZWSM_B;lW=8<1TcBU%RuyLr
z9c)vjcl6c4=4-@}TYW}=djYUZzGlZYCzw$CO)AC%nZq=O@zse{$4I2xfV)Yc{m3{A
zt3Cvl&m-=z2lI8C<6+{;-K<RCLhB&wsEHyh;35kP$XBjU8p}62KC-X@deRqnq}1{3
z8W5my@&vBcg|~=q$@rN{dvulLYxe4=H-&d1kth?Zd_~YE6#!Hpwu1~NpORihy1#R;
zn6Yg$pI5U{{8okDNIxvC&5SH?TdGsRJ7jp}XRZyjm|(_-Uu4tFt@HDwo{sU|hI#jj
zyH^{rZ_ttitj&Zhq^qNRy1TUdikw9Fv$Nc+{TVRFO9y89jT^zzeO-~K*5#S>gmN~y
zo9<%b-hgFw2RmJK&5zaAVFwT?3ijn#KXV&j0^^V~<<bM_Ncn`zmIHx8?#`FTD-?z@
z=B9;gfx>!?4X3Y_`f?_y;J#tCJ~UX_4;CF2Xx4VBPnRYChG(-wJ9&(L)Z+Epa7+6@
zvr$zgK)dNf_)g+gf{MdW$zSRxm~DnyucKX~ILcWiBn&J|DA*kbW&a%3>gXep+*=n^
z+r)4k^vzF;{X6hVRFXG@w#rs+@crL*cIKJ?7S8kCUl@pn$Saz$V`5+?u5oGSZ{0Gy
zB=PVGw|xgC=2P}dxKnRdhA2N@rv8&B!z+ya>*bWV10VzY`>%a7Kj$D;*e=eFs|?MD
zhWakKx%ci=g!A;fUMf}l_W(OW=9a;-hAC_BK~ln1StjvWB)>EF&Wk);3XArM&Mq{F
z2GbpR)ke@*DW%!i(1G~mpDvKR&o2Mv0(`Y_J^^yYJD&AKqa<Y|O)<88r}*aro_N(_
zkfa?+)@4d_c3JKHuiCh)s%62$FVgr{vfLmz_8X9R52_@ZwG>trplEz^jzb!FNK3se
zU^Ps!>UK-$*>n^>d6<r>TFz94jp6;a<%QW0T+5-K-W!!&QBjrYVoK5kj>>p=04(Me
z$uCL1HhBR;hxsz!Ip|A_P%51eV)5b$;G8c(H+TKevHn8Je*zPH9cfT`wd-@BBc$Zc
z%W%;f8>552`di((A%hZlFQNjLQ6^wPB-10Vc4hS7d14aS*Yeo4jvV3FZ;Zk`r-cW9
zp}BLvD-vJ)pAgE*qcFfB$f@rS!@XqnP~q7o)^Lm4Y)WRCj*?WPs)f1$KYvkfocLr#
z3dq%uVc_XmnroEv$?g7}pgrK40x=V#iMJD_BmFz-@a%&Xr$!Zd5O3Z*7{=ITiPQ8e
zZ-q(J+QOraTtiJ>i|A--Heba_*BLy^hVyvl?&Ll4+Yto-t6SPcl>*1t_<)d_jszSy
zQihZ%vZh!Tt)rA4)WwRGJ+`I9p*NGMCO^hWE1P`yoBchy%5y|{B%4!4e&p?4e(v14
zs|9H%B}@cAzJLGh8MF6{E6}vsQ-CXp`ZAf%Qq@Zb%4Jla6yb+8UavjNUmO-9Zgkn^
zt5*MM&t3_g3cCRzqst}@jE~ntI-S=4pp~@i<G;wl?kx=9MHTRq^-}hKXL$Vgzf}T2
zE7jfbm&GA6zhVi+!RswSBzgO9(B1!_9zU#rFqdEYIm(N9!jCt584;<U{?f4eSwM-I
z|D0nm?_Hp<ydsyC?i$54cKwTtM*SAZx?y*ws)n6}(OmG@-bp+&cgs-p?!(WgUkYZm
z{5GNg_WoG~@Qpp+f3S~|MRb$1W205~JtyzB;lCw~efWfg-DA@@E%S#31@58KsDFbZ
z%bPD*{o4Ga@RIi@S2v@~3`N6I;X>8;Dr?u@?epJ0{0A2pg8=uIRR-wK{Q^1{u70Kj
z2BjfXEV{b70GRO6)2CBsuY<=B=PsN*dlos*3w;_j6~-zlDG}>I6_{EwJ1e~S{*3;p
zpLxV1fm6HU6s4IUwFQNR+K<72WElxuG-2W1UED^gVXmQvPx#VbaqweV0M2*>x?<Sc
z`dJFc%ggID3G;ZT0R-egThdfUE`wLXgrNDZAB_G)jrsT5{yrx1ez8kKb8T9r{=lhk
z+1Z!*$>A@7OxZh+652|DHv>iF!iCEYOqaW=^UrHA-g;93RGFP>mmwNTf73GkbsNAK
zMM3;x0W*dd_Y3BBW@;Zld2-s3bd*f3E&GBs^@pf!;kyqX8qOrjy-ifH$f3ZcFJ3sd
zJU{n)g4lmn;?VvbA3p3;oW4+x24}s$q-|NiE-t>pKXR1J-?J_Az<j~WD4w;IahUZ(
z($Dh$%j$gxO-bgXg~j8J&Q;?}czlLVLq_ml$l~d@pTYkLK7XC(&vtd@(3u_9&lzz|
zdnZq_gq+{}!{~Xny5a|7IRE`y(a%kUL`++L*`Llia-1xziau-dSBaHJAGe4Ei&LI%
ze{JvPmW+CA?Y*o&<Do#}vSul8Iy?}vD*T<I{2y%d%w^y+p`L?N*Zwlh=jsmtQF!U5
z^cLiw2xkADHM_PB#YYDPQvR%UwZ%4R0(Rj=ptOVhUo3xH$d_XPdfWUYz2~pvy=e9Y
zC>fWNljEL`Q`1`f?(z4j;qHC;@?{0wAHEx_4J?ghJ}Vf=ItzmHu2iRS|N4PSkm+NH
zT3T8fU6&!kQrYPj0l?t+PE|!kGe91wRE^fizVU2&`p;rMK&$FEd2nA;B_tlM92F9x
zZ|+~&rUnRyl~==TZNK(2KB$r(-2?l+6qU*Na=U%=uf3=~bLg;`T+YXQty!T*_<j0!
z?%e4FNDRVci_gixKIBv?8`+t}n&e#)Ra$#(co(40OWqa!s|oBAJA{ycp%w2i3ilcz
zj<Rxt>kr+%cW=FU>e%vXeF?l1sH7q$qN-{gV;pA?BX(9Puf6&%`2S+W3E#g~-7a_3
z$aPl?M11}F)pBpjW2^7-z#}oq2Qmf&gn5NFGT#a*s(n7m3LjvcGx-}=W_6eA?#*$V
zm(KSi1jVc{<v>{YF!8bL)<6pY3d5ctD<fU2kEh?+sU!YAx(B11x;58+&e4Djonb)9
zENoX&LhWGd76roA_S$@s%S%>3wVlOZtnSOMeWw0uxO(}!8XCa4F|fKWK<?nk^-3B)
zE_&GM$zNO_?AAq@P0aX3kg@pNwYvS^r%mV>K$NV;OX{n)V4q8FYCT8zDXjcaS!G+u
zPk>k@tqP@l<^V-aHYMJjWUZYRPYU7Ih2aX{>#F+xS(z!s7O1`_y?gmx)-n*~3i&!=
z^Zf4fB}ilHpDpRx6tJ^-@d25#N67q~Gr$#%mvQ<_hibMubfYCm7)ZILcn34?`!f`d
z3;g+(QQrpeC-;2cYViNzR!!f}tDcq7gS36l%I(XY`KTqe%uWuec;cyFdaL%<ae!3+
znv|~l=b4``+VaUp_Jy1xn}|u0e9d3G#K)bh{Z?_o*#=ksi(!bz-aGY7=XLHqr`?vQ
z2TCZ6q0$ZTNRGGxv$p>>$mTupL{!iM^apw{l@|O+0)6J(>}pX}VSk5OLHAvLn=hJi
zViU7B5St7yK)%AEl2J)bDG(s~^}YUZySLnVJV>zW!d&@J_Hi*IOnIUl*!+l8IQUO1
ze>v@6->5j`1UWoRQyR5T&;P087awJV<zF?2BEh0@Z-3kfh4!g6xmZg+9MYzzF2YJx
zZ4mV#5zi#{9U=1uc)pC6v?_d16lpTiyawvyRF;dzWX%>RQ2J#%4i4x6ugfy6OgHNj
zOJC=-LwaKkVQUiuO4GlN0xVudv{kf_!fd9L%0cXW@J#GUOd3q!?%lhJ;nY-^wH&y=
zGg1)pBSA*_c$B)W{>M!1&pGaBZ_(tPp2vRQ%wJyq`{;YV+twd`*KYci-ND^U5!}~(
z2~~|1RVLyBg((Y%*PTtABi%&fqW<aP6&PoZXI@AA8YYdo=qujUd(yptOz+J$|8^wC
zfY~0+Cdq4|?l@am)}4*(fB<@sR4J0D7bGQcrYUghLx|amBEWzvx_YhBO~J9(6t+Ii
z&jTbU9K0kVlGo;=;L<zwA(!$cwTMzsR9Rg#uZku(zWh-E(_vGYg8`L#SA~?%p4C$*
zr+u52wK4j9)nO#<65*;@AK0*`&%|azxx5Ot=!czKPbO|w!VoccZ?3dOl%U<L8*b!{
z6O%4UM<c#Dr3!qQo*gO7_(E;(V3z)YjQVV=3JWjNpN|Tvn<u~{4CRW1a!E2xn57ic
zuvfy#$o$@8q8AL)o{SOZH<`y50=Z~IO5Bj2Xp=GKqLEwl-o8E!4QHF6xAafK4AkBO
z5r+4lK5NCnp+MTEPxr9{C;SoZE*|$VU2M;>fk3a78=T5ue6C@^*XB5}b%OBnD2HIS
zPLbqVdrh|X<RajDVf&7IHvpT-fO?S50N&E8C^sUr5u<h-P?Io6MnC#I70P@)BV=ac
zNA`iHGP;3?{y{-VXX(Wjfb`Fo65No3A+#ZLO&It6q6C$FXEOM0d?BYyx$aNlcykoy
zYR?*%T&#Cggpk=HRdpxECS{TUcdl7dq;FBs_Ku4<H~n;Y`|h1L)e7TUNuPt}x%B3z
zIo*rupLR;k_3BU|3U&lbyH_!#RMrPWm43cX)VzPcvph$ZxuAi-FgmJ6Py1jeE-9o3
zlNj)){rL(=&-&=xM`^ey75WJud}W!?iPhKguB*gI-8=pjslkpFWGG{2U$&k$zomaF
zVSP~m&#i7;Uu#78^y(e(Ubx6VlN)bhkFj3zXZDE>mjmFG+NNnr;IQa$iCwrdcc!mu
zI&N>wwZ+d*2pqD_eA*I?oSw&S1?9rI9NxYH3k|$Gt#CX_xdG<qN7<Yi!X{x+Ho;~E
z)_C`>fr$92CK2HUm1FBqCZZFUn~y~XxqreQEQ*9Xe=RdBUAFK$;L8~4#^*r??P(oq
z{ouu4&g;wsIXXq&TETC2E{eV81VTE@ssYiDIaP%Y3&?EFXIaPTh>oh>cu5PNR*%N1
z%p|4tW(hN!A{U>^$u?-CS+YliGiG{HCy>^cLr;}SlBX5+>=ijpZBHP5;w&^G0_VEY
z=)q|889<YjCKNT{%^gAtK`p&tOUxrMPTx7w09UH7&`7+ef>oK0w&Cqr+|a5&`1=w2
z{Vd>+s@08}rAQsBWs68_8Wk+2nOBPHr6;^<X`V7ALBS71^=(Uo#yF^*Im1F;&*C@N
zRl4&Lo1n!aNPNC=TMbfL)yNNT6EwJ%5&&nr`8f}?lM-(*kKetw$wEEni8Iz|+(Flp
z#@?q$aoYKRD!7{3pjp!ez_~jU%2M-vQXvOYLPIE0(%+G03s1(LoKpO$NF!qh!ixGO
zMkH+(9v8#yQ-)_?7ST6q0nWXJ>2MxPl3x9N*|`Y&euK=W$F?~Vswg{it+G%`BZE3{
zE?!SpRn<~DN_c$7&+@igV_3!vV+RC!sO!s<oksblXB#<`WLXmgd?mvjkI(x0^&F|P
zitC=yK)9}n1P^rY3>E6*;ZL63;Rq(ny*tUykIJ{uFgAWV@mAQ|0$~k=N_==#3bC7~
z(D$B)H9MiMTMbwe^@(UkCmF!}T1zy*wG;s#Cj?Z^qdP*(0QGL`irMiKAieUN1686m
zgap4iwk1`*uQJTJObOl32$XzINON;?@?5Cre_GE{dpb9`pu~OQ<<o(OF~_6Tz*8~0
z&XWQ$usdZ=_>8K4$g}NBg;v<!0x$&aSW`(wby5-1y&Gu$DWvF8%O9?g+k>#)O0PXB
z-pz05Pwph>pr1|^Hv+Q$Z6p~4%<<hUn+6Na5C|WuP3`}ASIfty3fueb!Fkx~m`LGr
zcfLZF_|<c_RwiE;q(58kYAbgF6qBH=Z7R&=Lx8M+DTvH|bhJUY_p?(<p@93-^qIcA
zJlD#r<{10W%_f%_4MF_^5SOLNg7zPY%szSt(VdY~I?;@oMZK?L6_9*}r?Z-c%m+hv
zGj87VwR7}Ez)+7E1iX5!hU(bqxey&47Q(N<c*k^2M7tkv<L+hX<(>*+sK6gy*pIe~
zFz<YPY^MwkKGSVzBzZK~LEz)^&&4Z9ccHJ~O)JV$kxKVyhdyi!W?myGlQYBZf+Kc$
z`Byo%K`>R6P|SK_JmF+7IWF>~iVo^}ei)kXj(I1nk;bYh?z?3ImhZvYg(s0Hh+yAO
zr{t8HIi#BPqAKfOj;Elq-)KwQIl|s$6(Id3@~jQO?MX;-H%vkeRBF3rvc7ER1=ER;
zsiG?RsX_v0dGIK2o=cw?ovqiQS|r<kL)(pLg`g|c1Jw+ARn}r-M*L<6xN+l~zA*VR
z5{T+HHdq~fkO}C7)cX?4@y1Tb>pdwQFKj_SgyD;a4+vcCZu^NET5%o#6`!eUltgEU
zCyiUZE;!JM^y0PhURcA>*TJxX<b|qTv((pP9nKB2MQe`UtSZQRm%hRY6MvxigRt}D
zyP;E8U5kloGBSF8lp&kiS89cm8VX(^{z<5UzKP5zf<d%^vbFIdl@6tMZo>BTRvMrs
zS_I9$q{M#uB|dFGPOco63>-~k!(`dCwAM`y8|lYTjf6eH>8NoG(etJJWZfjyCZ2_p
zN%#Y$>jQFufxj-dC8@Q*++fJhoR#-=!+9~8E=@l(=mj9K1=`(+kqVm-l+BVUlRG(y
zm!p`-i=f$!g+7fdg45(@Kio%lj#l|#{u_Y%|D0vVOo7aa?=N}O)X%(PMJFeGU5~3R
zcLA5CS|7`mb-6ebZ*cC|VZN_S>__Gxe;Q#vcx?ED<ofykn{&EvI~!I*LEp?llk?<e
zZ&USTqfc~6De%RoO5RV!#Uqzi?P|OG8n|mzo8{3j8Y!W1M;C@0w3Dp<alU9$=tgR0
zt)=Z_gzp!ebIh<<+F<|!aA@~1?5oK(E=+R?(h;RLR`D<b8#u;E@^TWBm>U&8nR?Th
zZSf{~g@&mZMS6^f^2$g&B;<IpTx+34*7!DDk$FZb^pLH?6R}unhOD@tAk8sM`1&(-
zNc-n37Jtw;prS{m8QnKh5lB0Iubm_hlv$~y-+UK$w^Sy_8gGuVnHg|u?;oZF>!K&C
zzrBe;I(3kNwuw&T0NbDy%CK&l>R!iyM?w#S>caO!A2x0%w~%!<*~2~<200{A3HFr_
zR#q36bCUIQ>LGW?^ov#1O_(2VAnilA(7=Mo=~<zQpv5MqM5TaNHRo&krm|nHGY8}_
zC?72=N+uGRfKA7eSNj$Hqs=3tqZ3Fhag)vLnZ8^MdYf_n>RA9tMHLlQscHx)xOxwK
z_I>E);RKC1n<di%5L3LlgFkD03l5yR_K1DZEr`?RJ|cT_Vf*jFltVB7^|hY@zBWr$
z@qyFnlW7%ohNLw@U!hJfEh}SYIZ*F&4ST@k(o`sNPs`+B>(BR{@Y&g29zZ(bWSauh
zv#bOm%y!Mh+7s1?-cFQYcNDtM0DXmQKKyuON2i8xa1AV&yhgQGdIgK`Yh{1X<uw|=
z6uHmaX&w96ZFrtM^WMTNuB$^WJ&-vw=^qRfkZ`moHq7>OK8$Y~4`(u&CRp>O{``X*
z-`T<|VJto+3&{Y8F`C8s#GmSsVP1$u;q#h;>*Ep}iRg-o>upKwsJt<E2WLS3fZ+)2
zo6TJDy)jm0?<st`+7C4s<6bYItT4+Kk+5LgC0!NM%^$;dq2bv<Yl~7iu0vnZscZ9x
zGhpwZP&70&^0*w<6yA?AP@V%QDZG0?*dyr7{y;icBah{lwn%klA%Y9}sL65eAyyDL
zs9fAA_g8bjX&F~bi8QFab2k}~A?fpqkYvrm(d~-pFg5{#fclKxrLNVm9a;!|>7l~Q
zK2%x&V=5+Et*0y<;fZAO!^;e7!_`uxaKbX4uZwmQ!dOZ2?w$?_`2oE45;%0Jo?@g~
z1K_*^+ZpNH(?FMe^G<TSf_Qt+AI|kdbN?>x3t(|gBHs4B7Uz{pbdjU8>K;s_e|vq!
zVIL#L;M+HD^T;eQvb&CPF!)fuEW_=rfjED6nF(5g-xWF3dH$8!_=~!1eZAaAgyg(6
zT3nLH&B;`JVI~IYgb+x3r6D&@a+9A-JIO~wo?187sxo2FF}V{HJQ&%fqvWg$Srtkv
z$k|>`SsJ)EJ53E>@r4zyu*v~F0aZm&#YT>sJf<(7(Ze#{%JOKtj}FtrC$hXKfy6!t
z`lIwp@l)UpX1-c)0+bv2aemfiBckZ(1g{!qTa{T^=5V<)kh=5HQt@2gtUK?Ge0L11
zvkuURzUpA<oD8MU&NkP7bMx?6psy#&yZyYy7%HQ>w9QZeZtBYOhUO|$e1P}|`?3LA
z+B=gaa^4$=54Gd^k~e30T$g^}Rau8(OBl<d;8IW#!G)4m0G&U?cPi6owm-*gY0}*{
z(02?!gj;wOHl9QZ-3bX9FCTauf|Be8%TnAX33$<~4vYKS5@of0VJnWIaW_lNxFG)E
z0{#YEb`r+7RUU_yQCy9$KI2A2wYfnu;=1G878G#k#AU_EAxITR3ab9(W|dnKkrT6p
zVpn8+`{qKoSR%b>nP}#)E<Fkf&KdkeKGgL(V8O#r+{o+UvGqqJe*78%6d-LhXcm`P
z9?cId;sDw}9TNLm06^PqX{p~{rR;LATQIE09_b=fi1!f1utS#{6=RnJtcv>`b%?gP
zLt&XkI*C6W{fH8t7W=Q=xM7(#_9WLV9dk;-{a4Zx6}xo-_by#fUV(%bK2QU5a%Psh
zs@3uCRI2+Wlwd~`n3xK$R?IcbDP5rt6{O;M+jHBsmcm$e_i}?dfdnhr-Sx8r7Ab7D
zWg8R<u4(>pLoF~F<XT{6vs<N8*H}r!jlI;tEOdtse`c)!4^?7K!Fj}~3?nt}&w~!K
zbJQwMDv*ji#IUpRZ>qGwqL_W_8)adEwo~cu)x)1YnQ8}4$eHYG09zk&Lv|!cm`$pp
z%+`&grao#(dvb$k+X50*z=dqA%0Jo01-ZcQmVomb3ZT?rl=aQ%RE4}JwOpZ6f9l#)
zt?o7Vxm_$>i+NUd`YDY5HTfm-@C%k|r$A9v4xpV?!O&HlxI-ghDJD7%Gn0Uo`%?r?
zq1s-5(8Z{$0_7>7?D1a)I^Mk7OI-lgL+x`LlOm5s)IzD*Dw%iy^{i0xF_`yEzIRNV
zV6I*|20CT$;6>o9V7+<8<ssy+P6#1MP=CQtN&Y(>!0fEbRPHRC2F|xEsT9m?Uz7Y2
zK|jjQ5xGj+{z;{{M5au^(h~!BwXk?Pz$dz5?mO<Dwi(L1e?_uA>7tPEAHrwbfy5!<
zZ99*>9>bSh5NQxU>li%~%d7YKzVi~<p7ust@6NO*UBsQ?n{nZy{gGvYU*rAP1{<3x
z`ywu9WP8R%Xe&#P;U#;A%GflerTiYbXOF5R*mH5KKW4N*I&Nutew?PJQXZ`W*S9>`
zfF#whBidqcMh*m)JcBwpU|sgiuSQ(DVt72f)Xc{9UH}k!xQahJs;lNXOu4oC`o}+h
zpL_@WmI2KIkAkRxoNWDlAa2oy{;*eKj^uZjvYCSNh=JAtM~D-0HMi}T?rYs2rQT6-
zfh8x|@*veL$EqxuJ+>s7e9P8J?Ic(ll17!>pVadZVi6>N!LVHpJqeJhc2MhLbXq-^
z%FDV~3}Vq$hn7{oKBn)Ln3r`gy;<h&R8(-hs6fiJX(bJ~hle6RyFoz8M9f}i#sY2x
zJ`~ArPr;773;xp)od53;><I+jpx5L<Hl<gur|oOH0#e(yx-oOhx`wSlZSCt7m1TC;
z?zB9xl0OV%?e7fPDRXL7UCqSvqN3tmWfbihv$`N4Lp|tKPR=kAj0P<glt;CBb`+Xb
z02R7hfCPEjGOywOq6ps3$b3SO@fhs6uYwgCP*eexQTQr!Q*UU42MWDrFWdX^{xaM{
zxWWb`w|)=2eQiu?`!5$@*FpUMVedVon%dsIQOm}Lif$D)T{i*(0vi!f5Kt6QdJzyp
z5s}`cmykqJEFho)A~n)$LMIRiQBY8NZ-Io~N$3GW!kxJP=e_5g4d*>~jC;p8cZ~N7
z`^$D^t-0o!^O?`Df#``OnHJC5n=F)rPcy%mEr8{zuLHAMr4Ll{UB%N8h4FOfqCf&>
zb|i4MF46Z#)K<PNXG1h1Bk8sZwnY%PruQ)<f^}U<t#$tqN)eBSh^?gM)}5|ABW?Pj
z0Td{{Y~^ME`ZC29sJ=^9!j)g`T+v&;7Awz(T!GlXf|N)@b8s1G+ad@5B!p?gons-V
zfb)ULgfyq3bHYY49y=so1DY@f1&@M0Lt8CfReKNM4V5zT;{X>l?eUheU6<PUgL%4M
zn%X&UnQOac_}-KNSTx)6zTRnoEW=N2ouDkYpMjVzW279drTQD9#4|wO5`3XA`AZu$
z&7FE#cSos@0ll@wUwEayxP>a6KRj;S)dlD}$+3Btf_tZX|0?GfSbpRG6Tw^{;PuuZ
zgM<{W?~~<xVfOl1L}J;g%JW>Z*j<CGzF7WZ*WIQ7-y3R=j_9V`#eM#q0cO{7w6f8T
zAAb+v&Zzr$=Y@X<K0N9Dg@v~QEF2;u`eob2<A~$}ol7##4V<)oqr%+__5i4Ud$;rW
z$6o@Pz&_6?v43~T|2SS;2Y?9i_S1NRP$l5dNE;rkLJPARHEF)3?195P`ydJwoUe;8
zIe=UEHw12{WB%l>l9G~x&YJ0mpq+FLP*;3)&7OL{9AV9Gu?s8wU!1X5$eRI$E9-2Q
z9PN)@F;i-4YQPK`l?K`(uVGj~K&1dmI77fd>2XMI`!1i>->u=3iqDi0uk4z_?hm@J
zD1fGN`GUel09s!N^q&BlR%x2Tg$uV3WUa2=bK_mv_ktl#QS9rt{1n^m|Jhpp+vdFG
zfb=M%qUnOak7nj(e3{Xz$jeJWzuSZrtZb3A{pypyK!ksYh=}_1DRUK?8ZHyr7Rzm^
zrXjSxc>TaX&jNoB_st>ZJ1^8UvoFrJV-MfY3;g#0_Ild?0kC%#&i?~o|IY!i`N=(U
zKjl_D+7<Xy)6aS~_VMn%D1-2qBftH5Tggkq_qrLkq4Ej7dSSqWnmV|(BP!R>Qc?<p
zYxiahFCwxvV`OEE?psG4JIWjg2^QO>V)}atJbVAVn3QqIsP|0ML4@PO`!Mcv##-;+
zzpuI?%OnqXo8w&pJ|*>U!oz!(k8*Zi&JGm2WQMxNbzN}JZ%=|bfTuzeUrW&?{lEqX
z2fOoo272u$d_D;by}%Ly*g7+3@FsjYTrF>Dj~L@aE4#17Pj9*%?LEH5kb}4OW~T3g
zVne@gXD@bX9j%r4+_J|d_8kbi*a{`MYrb}vsD|diw0$k^=KEcL+f<2JP!JGM!JRP#
zJemKUet!K&dT>~nK&3c(aaE=gS-veU8b(Me>x>+kanMP?+`pUIeAz%*=A-<T%uP+(
zJr;7X?(Zu*ymgc!T82?RX6FY0aKzDtWpXXg?)R<}0E({fwiLM{u=$x0@V2!ug}Qp1
zp>VXno&wcIW{>4`s1@w~y#C7?w*OC%?CZlYiBABfKPa2AyU)V2fE|Kc9D2d~@dRwx
z*v98#H7!|Y;`ko-?hEcc$To(;2iytbnkn2zDfIM5w|BqgBl~uS=8xaN1$lS={Qu>u
zF9KgsL8_JiY^cxu6902%0eu_Fq`m|3mb6mt&54GzY!g(WNjy|#e^?|9eedT_z{1vj
zU}s0>EZT$iG`5rVscouU<mUE*s%<D|-c_T%A!cWxmTdTKzOz_<HfocSVJ6bq)7RDo
zBLoy9iYDd=pP|As2Fsbpj2{KC7a8bNb9>UP9kMmcvDv3slTthH&ueM5j`VWJR#CP6
zCgFZPCZZvP=`ar$Pbsgg)|-$Ik5+$_@-lN{&kxf-xK?$&7F5Y{4CnN6j{6uyl%YJu
zqc=5k;F|_)=I&@=1N5i7<*k((asS6(P9;29D)9IG@g;z}hA>?e&Q^b5Gq?ZxBr;7x
z8=soq#F^toNR||8W#S4<FbbeP2cQSaMpb5w=A_Oh+LI^`J(qkcN(iE&87HGRE*y1b
z9=|?o4Tdb3L&|=NCWes^GTR)YtPpXu;)&>zO{+m<wgK&k)Q#*ahwkj81Uc{NjHnz>
z#`nooIg%m-W4|iy=tX9--GFgB?Pi#xQw(OL^6YF+TL@nzQg`-p)X5Vqop`CEw5vnN
zbL8cFs_{u`mhY>arTJ?!Te`<NAfsoyf?qc;^&5U8cV-l9PZ8^zuE6jT5-L7UW@40q
z2p<O8Pa<x>d%nI?w@&SZ=Xw5n2{NKf4Wi<l=Pp+AO0OG>LY5NDW7YybUT`$ueBV*3
zFNjMjFCw-5kkFpWtUa;h)mwd>Ql~&I{QdVcQL!Jg^Qs=CMrd6(w{D2`qR$X3BFwp#
zvty+lQ@iI)#&hz%mUToU#r07AQm|1;|FMv4-6E{4r~N2({CK5p{+v&hN|VE;+qigt
zg>9ZcbvnHPVm2pN3yxtk?WNIS3Z+?zTpRh6<$>DNfS_ak%c~o)3Vt667#Cdsrt_+-
zGpSTxT$>$b0XLuLxuc1gjq;?^y?;_UwyQ7VZmjy@^Z5Rd)=*PxU+J*{GbHS5tJ&r*
z1D(3#YxI;e`C1K)A6jbno#>1$^}pTqR(SNPzmrLFg3wX_qUQ2r?^pVoPhj)i&19Ze
z4c6v)zO0}5k>8&EyRJ#J5o&TRreMQ}Iyp1;$KZWjL0ItRjI(JD_30Lj7GlEFz6T5h
z*LI^zZB+w@Nos30uGsa?2eZsm@72<jX@P3|x<9JUDkmi?+mrN#bw9r2r@b|9WZ<i)
zTZzj^cFEDkzv3l{RId#QkHm4fIn`s+3@A~M6cql9ca~OGq1utA&gd97017NM8^lJJ
z_09X-))4hVciucYoi&5qAUszPRz3loESE&h4o?+N2+n@3BR69#Vq#*@FEnmBBM5If
zBn*-8tsv4c%)G8aq>@DPqrP%3q7X21=t)&YR0?P3s<X?5C*T_ons>Ftw7_sdecJ_x
zUu9X(iVV^pI*;^DXB*<OO-jqFeR}EKE!8x2beRrt#eeTakg-5OmWlor`b4fAAo%r(
z4`+pCvk)P<QaOya%*B>$!}%0<PdU6qfsD+{f#p<}=^is947L#y9@INLJZw_BLOpnl
zLiKT`RYV`FK<xZF92z%XVw65ruB%PXa|{Ukr@rL3_+Mw6pTox~pqZskncFau5SsSK
z=^FOR1kl|1t<z`QvNZu$?PQK(+uTdGik3~+jeDGHwfCmkv$=Uv+Exqeor=wI;9-7e
zO^@+v(bupmtLn$;w#+>khDXP|zYz4|($zn20GE&r4>pITb$0CJ*JrY{O3479h8%It
z)=e+YF0{TQZgukp>H#BqrYkR}S*Emu-8Nx{(CpBPSYSM&16{MpY7d98am2)AJet#W
zW=bT~stAK|9z>Vq^au&r=ZSdyt}olqodPEO48q8jwD|j(-%Ez(l{YsVD8-h8Dl)T#
z=AJ4K&Ye}s+?TX9*Wo$CuDLo)Lt^)>m#Ng*eKErs<Y+Z1krtVPsON+~c65spN>(zg
zWwWM_Isk|2zH(GrYN}oBn9S;8vi4vLn`uCp|H@2uX67~`u4c9|fzHz^3acoeZ*rfD
zWHYEzDi5GybbOj~H~gsyERmqo=^=hiJuO+id`Zf1cALJzJA)S`bQbxrkygV3$OZ}C
zDw4)Oc^z5b5ljwkJNL~Hg{LGxXE2Y9QolLQypUO;V-zc_ke$T^{)63S9Rf}5Y)ClD
z9VnRH=Abl9lZ{D|3$Ms+t7g|KMi}!C=Qx2TjvUIDII3S}gnT6i?zH7obZ7;uDjo_|
zDcP1$@L~C5M6LHSWb@UGOl}5RUT*9U%vS9;n-+rajg>K+Uzmq(HLZmektGEN_=3VM
zQosfdxQcgWH$^!RlA<a~fvtz8uUG6xMp+|H`C-+BOB#|fn13&#R;$O_$ShST4@cfy
zsZX6;U1cNLljoS48_CpJx#D)^XtN;&UK#&FsL1duS48&`$p~9`%Z5H(XW_7TSbd=X
zj8SQ&hEYjn@fTWSmA3YAc5;>entYZSCLOxZs1;`4vq?fgqGE)akjqsSwiTYP$VvJ`
z{?J`c#y8z|2=*ChWSv6%FiwVsQ?h#@&~>9>b^Yh|$LZov!q{vl&3U!KoVe1hcjwAp
z1<kJZBCbMP4q?pZ^Yu8q?i+rF4dN}<(Q8d6lfpMH-XF!FI%z*4RNaO8iLK~TBSJ^S
z;AB@#@_qiw`@dZI8|3>-Jfa2gi@{*50(!2DB?_A6+ci}y6Kv|%%*d0rDhlKreMTo=
z%X9_>;ihPW*89m+!75;KFG4VpeWbc&GLdIoNt>C7GR}%v8gH;>@5#y{(xF%c<cVVD
z_9-@Lh-3TQ9gtpEwy!hLk6977K%BLEZWZQ@gcO-<9z3+VxQyP~ZaN0MishdYC{+fU
z+6uZBFa~O((d6?{Nel0gUK94u7SW9KDvT{tFCP-B?2N|OvbEb#?h<ma*e?~1;cK!R
z#RAO^o2h*pWLL>-(N85`=sVd4$v%qRff%-I5;tb5UBtw0t+Bj+ox(ck=c-7u=P7s1
zY{uo6i{WQ}ml2SbW}Ps}l!LWj29#M@WY!t;o=pV9YrFJ&u;_0J^hW*24<E7_nB#ga
zL^H3M>87(h0M#3GI~IP#sNCJ!n&o`6EY*|EiPBr8Ur+!YI2bx0>H}1p9Oh8#?DQ7)
zyicF(WXxFsu~z{4&N9tCy%FBk6i+pQTU}Y`{)#P~@7fT{b)u3|SdMqR6D0p^6U_<7
zuh;PVeQfeWd{y;#ZaiB;2}m$8^-pAM!O~RZ6}4(C0yOG)NUb>eg`cX(*|Jei?BPq|
z$9YpETdp^uSQcAiR{^i#@MEgwBw41cA8-Ue_K-x399t57xjp9EOg2Yd#qz0DR%<G+
z2910a|N6pB;z@)pkF#J$Vne)~368}s^ZxS7V|O)S9=Y|ALJ1U@Hz;uGt9_wgBt5^?
z96Nf#izVzBRvhOjzZ~D;bvr{k+b|`2qB#~!?|i(B^D(-z)ju;FZk~_+#hLv5m1O0%
z+;y$ljt`zHp8QeFp-&{|D{{B>Zac>3`oFhc(chAmFNX%bG;&BDeI#tRK^*jd0__eg
z+z6t2I3P20g6uj=6<6;qt-)R_=U`kp59#%BG5>LxwD>ws6RwX$Uq{yf#WZ!TJSfX>
zt=7f{;_GywumlAu73P;}l1cFgL?CRrI)Z9U=GbJNVU#>FsIvCBd>=lEqMDYuhP3&I
z#G@HdRNkQqHX@;MAtMpm8&zJA-w|j{8|=i?mOsS(h5Ebzrx0;fL2jZ`<R{MBM#<l*
z`^B7HbqQ-dGr8Nif`|Jnf=0qmR3MNYz=og{mcu34$lSlZn&oQ0oWAYZ1H+VC^*s+o
z&->GWo!h}PBK#fm>0vGis7N*OsV_a@jf*!1CI4jhX<XM_u|Socbg3CB(P#Q&mCR=S
z#AEzB%W(YX)NeTK;zSq|+W6rp*ST|P4qZ7@EsBixbYLz;_ojXq(KlOHTu+h%D|$8$
zHw}CEBI_lnXr4sDDf(tkMfu_1&5e-*t-wctnZwrAkf;9mayGC{?k{4~(Dn5-H0G`7
zK2+DKPiuDeSg|J{2&-+?+5^`J2M++42tha)J|HS4ZCK&+eLAd)O5-{7z!&*GF^R^D
zYjAd1T}Q$_U({-HPqQwRbmtKEtxh8%pqYBDut$zky*>g^kaAT@MSIQ684bo=?w%V~
zgHvx?R;lh1sBq-0Az)GDKl+|e2m5}JMHmw`LYk4p#4dNWV$Co3$kDEsk-wqtsq3V?
zF3jdRje4<i)oU=m<g*iem_BDRiG>MLOi_N@kayBFze?a#J&h=FOrcGU)O&eq1)1yz
zrua?|nd6sDZgw+MkUWd|98wC+W;M3RfbjzlX?<{4QF*@G7GfK<QTqzs4aP~iBK;(z
z<>Tm}!^lanv4#k-=0qnNHROSwBeq+hO2OnD;74?tnd<nGK3mEUwr<Fh7BBw+oBH`R
z8<O{txdU}kt$fKEh9opD4HQ+)-v&P#;Qg8d8ClX=z*akn*#<1H9^=WxBu9ezxLj$I
ztgF|c!A5f>1_o9DG|-}dEPb6LssN}fm6L`>hiu!RA!dDNq3X#V7;o%WY;K`0s0m7c
z<VFn}uaH&IH*~2G+39Zrel38&fhvrRA9xTYY|t)IC$kWGZ;6PT@igmxj+|=>q|CW&
zguV&tm+^ENMN8xvMiyRYwL<{y>~+@W5@ok&`qC@tsUl0diYD@!x}#y9!JxlaG4NnD
z$iDwIio94&>!WD>Ts$>~l9`we;kT#|>&}7@qT2lYzwx2x-UE#I;m}JhV`|i3$8BEj
z_g3%CIA>3q_0Npy$DQ>>j-LdjphaH^oHkDN4_JS$pa8w}fkfBI6#t!*??3jfcN*G3
zKt&>c@qwEY98~vdZjchs7HMbodz~%NQhV1Jy=?RBx3yhPiIg<&f%T{ll9Ed&D1u#f
z=wrjWCUL*#eI>vR9Bfp=tbl{Z*gRr3VI47OD-(&z5sTtHq~VK<k57)1UG-QkQLT~<
z;0>v)riCj$NR|+<novvg9Y!`Sls;^)pLlS>gE=KbJ8|Boh6OsTYZO9s1SuMFom2(P
z?+ViDw4akadZTB;TRZ}m!2Widxl8o5Lhmq)4D2Zu80%-k+={-?2D<f)iW}wbHpBO`
z5^bpqHt#1f_$a-5ueCd!eb(Gx6|m26n^0Gp9%7#K5g#qsxI$f-2Ku)J*uD`O7hk`A
zasrFESw$_E_uXL3B3I`0`Cu$2U^m4boY(Bn@$(?|Y?V_SM`o?ovKEmQPFiaxAH+mY
zN7&l0hlJDM&R(OuI7BAo@Mnh-VKNo0t!oQE9Ht2Jkw(VR$uFtQ6JnkvGdLS+iD)um
zy4D-L^=>uC2u~)*m%gUdo``dQLG@tMqR!9a+LmTgCk;?4Qhu%}k69>1BqJ~dZIL~d
zUuc(oeDQc%eKieP1&N)E-S0QZ@_ljpFxM`gmkT?rxgqmwp!&f)L_svV)gHZgG1Y&i
zq_arrV4Ag!-AsC}>|D2hr^8(R@D032P}SXmkFLHXNo*Jz6;MnN)Q<_))Hb+p_sKAA
zuC0auXAWj^M8RpVlf)~27c#PdZYcP?VIwMTuD~4p>+hk-)ciX0Ru&R{&IUmUOelTe
zOyN9?H6iCU{V{ICLwFQJ9bmkJI7$2XDz3Cm4l*z+v*;X%wJ1+K&e%9nTalqOY2g`0
zF3ZRhk1uJz0eJXNqzDK3D>3YyqvnaJ*7(alUelZjPjaCP?>>G^w7nNI0KjISTQov0
zWf&~pUs*`gGs%b*hG6VgzlOz*t|Vxz^hj>gf$asl_EoPD&ZTOoYXEAldAdp4&GDpD
zUu9Ql8t#HFXz>`;5$k{UJ}UGXAhd`cce>@3fGsgCPZ$_p=f%^fHy@1-MP>Y)wY+z0
z7>DD2($6k9yBXFq@dp&D|7GR}w5V+v2+$*2on=_uLu$RJ`VG6X4ceL$jQQPWWN!4Y
zHrSN5e4?3zjY8}>AakXk3$M$pPN#>6%aKs453QXl^9MJ*0n2-4Qwvq%FwTKteTIX5
zfK9;G7Kq)PzVO}#4#`EopcjuF)*AiLS2cC3p^*5p&$Ms#7Y5}PhPn8&kM%16#yp<(
zRc);odwepURQct~z5NRa3D18DRRizuII$ffKiLWPDCuM8K?fvjy+NlU)@tpC(s^OL
zI76C~LFn7=59`}k-KiGY=S<YZdj^2f$6K6`f2F^^ln6xX6}cW)fOVx6-l(C?S~+Ap
zro9Z-);7R2k$6^g*&(aNO5DqDF0|N9Yd2h-UX>8GxZt?hI|r;oP+?m^(eaZG(F7-d
zM=OCaozRqQ5x91xixVP;HYkP4)5)5;1S=ndSWL$c07Ia1=E0G8??z@|*8`SW&yd9a
zgTFaSr}PItc9f1F&3tsFyH?~BxmvnLljlREDiM}|H*bVThkvz6B|Iu{?l&8yCCDrj
zt7*V&NRva(EJSguk?MzulbynHn#_;J82MVXGS*HFl}JRa4p(ar7HC~ZWj(S2{y`1u
zzz_oZ>5=O#-^tPzQ72b;a~3-FEzCu7)V9T!fP4S2Y33UQ=bQ81WtO@3+MPQpGl3z^
zZY)+#+i8ko9iQHh4vu_d-GbaDOT{&9(`6LPd7aG;<h{@)hm<T3H+`q0MBM`(7j+#5
zgau^DDW?=|g{=YkfKMx%c0DZOl`ZlDrSqEz=`yB=IHst1AENAWu%aji;O~#BjPnx3
zH`bX!b-f;DPxS~Vnhk6oWv#`_Is{5)nWiP90lA#<U@e20f?H)Rd`0c1p4JX`4{0|k
zdS$hi|DEgsJ;P6hS+gi7!Y|tPaY1U5V3X2?F;u2OLFwkwGE_oC?KfhwkR8y2AsCEk
zF8<)93SOuEqgu``?&I&B+{|}j5<JP@kxrD_oeuN4R!xgcD5$@yY4G^_(y`FDKiX!C
zUtCQ4E_ms(fXQiVb((^D=wQkU?q~2NBNfZGw8)tENn_4(gOh35wo%IqCMHVB$shC#
z6tVFm?RqP&?v+YbYC@G7_TygUw_|71=E6LZ`T`>VjSB!PP~e_3`~<8KBwU$a^d~3z
zNr7@or&kH?C|v_@rPI4ojjc#xyke%gMi#MSv_7TIh1XAv)D^**BF*0%W*?Z7K#`J5
zk5YdV9PEiNH2!kNJR$vD!}gN1)oN=6b!N`yh4?lsXs7AIyymP6$@8=J5Wq{AjMwu9
zkOFHPs{3Ea9~CwePyub2AfEofHH-}VoWfgS12t&@Q89TEQ<r&Bi}PZKUR&DIjl7@=
z=*Y-f17TTJKTeSvE2%k=F*osk1-AmIsp$4V5oP|?O@EVE*Mbfui@93^Uk82%`r}g5
z@*C<?>(K1EXQgIHQ4`M7@0aoHHXlwQbuwp5mz37bF4fDwHzF}(wdb0i=PxX9S($#K
zUBS~VspJPyqDG~yAvbA`ExXu0JO;i0!(Y~U!xk9tOucQ=nGI2AweJEc_H}Exppb^I
zqR-j^P2^Q|s-pB=+pCKFEw>qnCYq|JCtWr;gfKb-pER%?Q1TPOKSDwl%JDXm&rv7K
zf(FMMCb=v7tJ6WUk>PlDlxYlW?9y?H+w~{U0%yMPuD9(9@7{!iM(+M6u93Z9eR9Hy
zfy^Aj@e#Pp33sX1j7FX~*WSdQz>@u*<*JX3mSX)7ca*rsLIf%me|+XT`A<x3LH{Yp
zipm@rc)L(_&8sME9w?Fo#fV)>d8GVACyB-_j$znhxUppm(5~K5Rvy0;s@H3kPp>+#
z_EA+$Ew=un$iZC%LQlV30Hu=R3m}0AUZ`3>{FSsoBqe^U6TH;q5Em^3YjyCZL0wAs
zkRpBnDt=%MqyeP-&!6Pi&_*bGY76=Pc34L4{Kzx#C-nNk-BCHN9q;4kw#H)skYS7Y
zZvrxiYT7eGw1caS%Dxrpb*zr?#ru3Y@&6Tj;@kgXPvCj*=IS3xnQpp1&tn!%&dJt~
z!G7&=^WT-PvG0It?ynXj4w!0sbsX4orIH^WszO@XNRnHG4Pu6f+TzlCjMkUaI}PUo
zK<r_8if(7x9by88`?t>nU+E+7s6NMl!J3+y9%by@BeyR48$cr11H&o=egV8}U3dSN
z^}sLQ1u#mt`I~oPZ*LEH7o}rS{-y5vJ1}c^LlSBCYk}hV@cDchNi*u)gY-7tI$(!;
z<3{`fW8aOCN=F;;K~W+iBBX?^pK~ZjMT-`y?f$G_`d(Z5?c+t~j^MEeCtl~K{Cod^
z7Jz61{{X<TwDYRxIib!_?TJRCiqs4q9fIo+!#p|uIr)FFr!G}KZ7SRLrf4<YTQ{OA
zbE96qxBfQ+0XE|DQ!1ceFj6xzM5Lq)9Q8&^&cj|Y?h;ZW8{ZyOP&oWg0@lA?z>$Dw
zKi=si{9$g0sus?<b%)((7KpbSnShM=mHk%X;dMi$y1)S1D4p?_S4hX6;54Aih=0c9
z6B!S(;vce*Lq#(iCVWT9OsnSX+<~;)3!y`2_Zab;PmlQSuQC!4{A4=-P38ZyvV~`a
zfETUI*i&iGb^U<3U;IPShzMw^+I?Td*uYCup*<$Y|0v}?IHz9>7wg%@8R~Bu(y2(W
zWZt^&wC5bS`S~JP;iJde#{2i={RHZPg7DI-P_11KhJU|;$j8rs^Mb974Ypv3A@=iN
z-QK1KTlkxI@4lverOEX=tNk5cAjrp8L!~_A<=WiSl_DRppLuRx+s-bNMxYgK|KA=0
z^73XoA0vJ~oJ#wWmSMZclmH*$zvUMwf?b$QdC0QxToz1>fsFKY2ZIr5+!<;dTzw!l
z@@?_K|1!Yfz_TB%Po&;tWl4|6PJQ~6{T~txK72^VpDCSrBg&h3d$q$$YvYjcIS%&U
zFlWtnht_vKYn^8}cA-sK?@${$HH9bJEhtRXO!IFN#$o@hnt!tr0A>j-u4c)#){ZkH
z!J#K#@lEc1$;Jc7Ig_MusPr`2LG+&~27q(!+3?bs!_O3IGr&9XU!)kEjDFe#w&NZr
zoMFcE<dhVU=M&O<$clLrbae(nlMP1K&~zB!`=jou!k%-3>*BM-20=%)K@jou%S+(!
z(bB(O6~s_kiGl(G*>x{_j#8MP*Ol(^=58K6o4){ePtXc}^X5XO;;$G3MdxJ<7_pKy
zn^Yb&`cRjjdXUOg{L+c8`OKogY?9|5v__!wXL$<U$uS6oLQ<a^`tFBpMeoBexXeBK
zC-SxP{k#HM>5PRwTJxMX@HPE@9ArMY<pOsFkx=YeH`hJ<1or<M_mnjG7P#X`>l7z5
z=O1~}Hs8C;5qxJ6{TEeLuu}2(1Xv>XC+P3KCf<Ax3g{3GpB)|s{cBMp<t`wJxHhuy
z{@o4@0qr*LjfOvg`9Rf=|GxRa_KpJqe$TSwIS4aBEL;u=03?t<J2r59!#L9YU14`H
ze*3}3%e(LSjx*7(Kec<=BArYGY~8O#mzO|3Lx{$IJD*{ZrTW<m;9O!KD@QXkK$#e`
zS-|0oK5Ks=FGx!2Pft%DV_{Kjlpo%mWyDp!Q%?T1_UsgqMG>8lts1p#KX;FigB<C$
zudmIE%F>|HM%9dZ=Doz-2th$F931O;GzlxARsALP7>ij4!5rnZQ3G*op`K)Wi6AWR
zV=c;PI{%WCn7*X;JinZg!%}Ttu-C<t7b~~Ppjp(YFFsovCzt6(5D6(kGPt%HTJRlV
z^A*7Z(O%nIIrweUgvqS1Y_r>G4d3i^wqHq2;_fj#Gw!&Y0d`#!{N_D2bAR-oe{Mlv
zTUr&ays~cQyK%+TAjiOPG$PFC?%lg5Q@Rk_DFz5s7kRJ%5GF23*?R}p8?A3s5}mnt
zk)J_(q-P=&;_3Mu3uN@@wYhtjo(yO?xd*)AVir60&l2I99+++iAC4WoP>Glws|r3E
zGN5W@UClaJ{^(;^Xcn3cFd5<{9(PaF^oX_Fg2%myQ};B8idef|n~tlnE-H6aHfq$T
zO%BdpeY`67UH13Gz}f&7kP6=-vxOqp0)-8-b#mz|lS9<w0rwpZQ6lbTRVx{!l|Dg>
z3VnK!Kkm`!NY`9sEqU^cwyb%bw1e-rASzhvV<oJ^u%v;n*PS+fLJqBzTS!iZ8Qkxz
zB861e+V_bgrV0)tJCvgnGc@BE9rfdg+4b7G88VGlPOGgtc&4_wwVElUYb#g(ewu?d
zYJJ(&nYfNTq<HnFW~_DSvrts%;yq2yEdNm9O<12A+mMC#co0(<!P=-~VRG$guyZ$R
z@H4<XudDBN!cG0#P3y3p@Af?Ki(3vW!J>&Vvcj?=ndDNZKyt26mX@eROH(z%Z{yGJ
zX#)07I=YXs9PN0SnlMuo5NmUFJ}vmPM1Pe}cp?q<Y(zhz^RtuJ_gAUqqg-a$AF@@V
z+6+pxy%e?0=;bu1ayu*iLuL5`)#S`!I^gej<q#5N=il1+54FiH&8ILGmD@g;B=#bm
zose|ro}%TO-@n(MyI$Es%)<cpbMOqa#KSZioZixZ0^|nJW*yf&#!H-U(by(>{Z43D
zhT)c441nf*+TVLDg{)IhG3u!w{VeE8=>j80(4u<<WA0X$-$$dnU{%fhi#venY8wkl
zv@5^PqP<4@xL%Qd5s!PC?PI%Yk&cxnBSpu7vB|Ti*^^G+uKU3wa2!76O|k~t^`*;~
zJE<P#qlT?)Q#UWOJhsTw4q|5}OwP-Y^pygVv1^r<$cBCkggc@NKOeHHc!P^;mzlc5
zB0Km+?m@*NF!KG1>MPw7yauv-N*>MJQ(}u*U6h&T6mflx2a#3%SUv4r^Uv>EPkH6R
zOJ#XrVOOq5b}datuc&koh1pJ{(kd8j2N5k%N=lJ2iI#}+k1_AFWYdK0w}fQMk$GDa
z*Qq{tA7m<3SD$3HO{^1g@Wl_!vs~RMk@0Lfh?&my(57<Jx^yE-;B<k()}$z6e94!l
zLbMS+OxCMH%QoIG*j0|%R&is<Lo|SLrq5|4w!{ITrDCm8DDeheePZ>fxB|^kaXViF
zfc)vB98#Uelkw>dXs4u4?QH-&#;C||$F2!vlzAA-O_Xg`Ef<%q+%WTM`W_^G`4aHc
z&WT_ZTYmu3Hn9uIMSwUV5+$VHpHRbG;r!7zK~~C39gp6jEYRW+Tc7M@3+(v-1{uD&
z8A9=z9D;ZenQU3hwrdeG_KoWL#UtVPfdY_=t`-8kc55trdxQEhRKJ@nif$NS@-Wei
znaPvlkn_(L_a&8EMbr9-A1@hI#k)*(ssY+br!%c<k~CWrgq)#Ti*ycs^2e^XFAtKm
zZ(LQncMocSQ!xOyr%ydOoo6m{vOP71?;Kw6mcC$fH|P&1cSfG|k;iR%>qlirxtqF@
z7l;a68w1zU($XATVX)Qpca!(C+?7}H%M)BQeu0ZwKGcd%>RKWQUY_vZ2s(=P)NL_O
zSmM?O$JmNZ#au&Yv7Sl{t3%C8O$W~rH|+dcVzzO`OF43n1!G9bo%42uIH43@E7KvL
z=O(w&8FAHZPD7MF?L%GoQCpyz7nc1XD^QN%Xq7%a))8yR7+{I-hywGS-8M1z&8Q9b
z%B@MvHFfR^^9&AE>re=M^fBoiNFMMMiW0Ffj5dW=p((A|U!b+<)d>Z&t5!2yRJyNM
zyGQ>SwmgiDXlr2_qHMI6-bY>Ip}~F_PKlqE+eJh09oQjRXygZ7ce)uwomJ==m{&Kr
zaKl70Zq++_@khPS%7R-DR+cJ`+SCbowC#ykluj;Gk)EGn3~o+FcjavMIT+7g1z@fX
z7EUO-6(IvpF?a)kad{;RJIvja!6Ne*_Kz(;owOqWAmX4ui4wScPtwA@C>gglgu884
z=G3I*NvL&5gm5ydZ_7@U9U_xhy{lxl`KYcUNh3^@$#|cahXzS4bU2}#8(T6tNG2Hy
zq~7<8{J71CW~TA_&A3R(Z`|qQ+{cIH&gm@nBuV7v2KO}Mhc27>cLfDW3ty^Kq&G%%
zRe3ln-?=ljk!00bxH?Ye@<w4iD>_j7AMPiE@E4G9jmUf>X+9wMM@h*6r>3Xg+>q&H
z^=AF=_2(i#y?ZdkV0BlmyOXmV+GF1^;mko>I&1vJS+d`GaVX5$fBL%-(*0{yi6T(>
zY0EDK(gtjdNj^Pi&>t&TVWarC)s+-+hn4kV@`bxC%^1fYRz6v}qgKV1bOGh4V0TNp
zZ3w=-Vp*}hqeWqgN5eQP9?*-j;5GhYWu$zU6y`yFef<*eCjSKD)))*e<>QM4=Ycp`
zmd+CiXoK0=ybm}DHxFd9ETvkK$}U(jp%NPI1!K(jjQg)Vv-L8o$N_=EqW4k$U9eKB
zU?rXrn<y4Z0feXeXz`4gjtOBt`P(cC-WhU45(1?gU>eB511-*t{J^wEgeCTrfoAVi
zM|f3dL7fa}k?Z*n_Z7%4&*=~LGZP6MpyO{kUs2rM>@2ssew%NgCW7HZ1OjqLhq(s*
z1lt~-`D0ue^#&s45}3n(Bw$MoeD8c>9%05#&Y8@cnqe_rKQp9t$A!;H*?r+7@BcK2
zkt?O#Hyz+f=pEa}O9n9t^LOb!J$b#;@s;p3&tOhnVC1cfnnYLX+kVW;b02O)YiLy<
zRc28gF8Z&PRys+PnVhoR?^-#kkzJ|j#zj*V+tRuPZ=jy8bP+G_lF@-u^SH`I$0p*^
zbDG4bY8u`sw+;3@QKvyVnj*>E4?NDii(xL-nt-ceZgF{I=c{|Rd17wbhL7Yn`<#rm
z_+vSBraLEXp5UFW9e#`K6Mh2M({zY2AFa4D^&B|$yM4=49h`G=H1rva<DWMcplBLS
z&boRj^1NlTW<Ewi!pXO|5!Di8Qx98w2Hptmoo1@wOVP(kjB?9wG(HTv)Cuh2mp6Xe
z^0Xcm<cS+)#hmI5)Q^**lmxEj`FJ{eIg+&bEd10;Kw|T<WJYrvZCP<m1lT(GQn2$E
zsI4h#QS~m{@A+!WIhK1$acc5%C!Vm}y{yrq;6Y^FpD1IS<hll53-LvKt@8(@iLMNU
z58H8Daf=9;T;2pMN7~4)W;4_!-4`XRdOf-|U#G;?tLWtocr-vOekyFU`!4ns1PgJe
z5b4<RmdnSHvX&p=W}C0(ZfOHvWdJn@M&6OAZROEPe>SZBH9{uvcD==bY>n5ItZWsk
z6+U&-&G6e-oxa_cE!91Ux#>Z6TQ0>wVLKFs;beYt(o6Z{3)M7R^MG&i$MbEdcT&!9
zWK*372V0Pc%}`=YkxmPKtLzwuV4St0%gWjB-@dKaPs~vgixwDIPP7}#p-SnkH_-!x
zvx6=Uc`xf8ufEx(qw!nBPNVRx;dziibp3J}Vm?oM#e0Af>*Ih>e(}<N4$B{lp&McP
z?pZrb$BY(L7dpbZvKmhb$qN}L-J8au$?P+oL#9!oue-^ecf8D{iOy^q!?>n9rS76F
zZv!497g_)_z<+JOj8%VZP=uktcbi^C`rJVmx3*}Nw^aIEU)UdO!6FwrP?IMdI>-*B
z%a27wA2roe;=NV$+4}o6#^>gBUQ&xDLa9+}1q&+`u5eHZ5mD0-#7=@Mj)E3}I(Dq7
zNh!)X${)-#J~Hsx(yV0G7e(=5n&;)_9_M*nxk|o6YFwk>&9b8tIitZFk?eY<C{Yiq
z0{IXtV|*=?4oo`W?OF9m_g79UHpQ%>73k~gMu&b@&jTV#=4a3aTo(7=)))O$@gwR~
zVY|4IDULFd4;YOVq|o3nq4D~f-pgLDqQ8lRb^xxx4K~XX+VqNKEOwtPwCM1)(OL~J
zS4CgRiFpr14Xy6giM1waOe>CFB17XTY>bhzun5>R>!uc(iyEoaK_5o+l+i2T5$T%n
z4%~a43>VS){&P9O=Ne{{1P=j+fWBqHbsm>qsgklOCqL%t{%cxs*B~jiCk83kevuDa
zjD5GiEzmmGQ%7L|M~@!$hpy4ca!xF|E|po&wVal=k%zw^Hm7&ddFg!qMQS?#>@0D+
z(kc|*UtkD{c(mHlT%vY4Dy#L!5lzKu8-rlsl+}B3o|D1G=*!Jkb;aF6<1@nie45T5
z!<sL|y#J7`B^8?kr87q+#v~akhSwiE`aIQ1%iTTLg?vQ^a4g*UP24enitwEmj+WpP
z{8`_3L)tT6fiWbBTWWu7jC#U+4JU0g_M0eULEUSvT?NoM=Hbrc4==Z3Waka5zu6pz
zRHV5YVS2NA0K(RHkep1cWr#h919Z!nDank+wn*cY<%A&eYMs*1Xqf8|kDf2;Gu@fB
zEUJ`Ua+uu+L5!8Z^l7>F09!MpiFOhN6`~!d%psvg4LBL@C65A`^8%H!gIy^Yol5ZH
z<zAvJ7HVV^XZtc#X*QX*ig0r&N)f_^#oe0{?8S1kP$thwZ|$=@ZPJj{?g#F+ln42N
zQFC1^9w>Zl3SZsq&OIK{^b#ozeJkxUkV_*6DCKDc)JBajs$H;Vp?HMHMe**48Y%?m
zpM6VR%xgG6pBsj)VQ$UIxwr98f)ci{{yO*{sWMuuMAf=)Wrt0>*L=V$R`mRK3S)SO
zTq+|3YzM?5Q5F)GwRe%0x_HT59ITIU34>DpHow^yzXL**ym;?76HXg#U3Bk|9}L%$
zKIwC@nLahSOuCYh)2vx1SdMxrBJ%BHR9qPM!+ASQ1V5tEzO9@!x|;Fm&RY?rRmgxs
ziRF8O^aB8g_pWRV=S@vOD%M%$niO6DzxJ+FOkZD3qVLZjilOv()}`X0`-e#zF9^=<
zvnjwxkKK=j>2f@t@?OqUW!Xk7lT>1b$-5IK(?MXJFE(B`wE5<^W?b>nI4yXNy0-DG
zIQa#zo_4{<QMyhfm{hP&fv8j$=~CRYhf-rjJJX0hzx_pCdv+?tG0O@wTjE$JhWl&F
zz?oFl5k&2Fax>1cC#9*%(JL$?RPfhyAsDCSAes*qaYt&FD-F<gGF3veT?~D{tBsot
z`p_^;mF(;>v2u>j7$)VlKw19aUnlB!qa22Lo2sBK;5KUO$TC2r!B13X_=E+$aef5|
zR1j&`E@#Z~ZmAw~z*&yW)6tskM*D=!nq;NYc$-bm_bZVPotP~TdbmxfG|1DA%Sots
zv^usx3n*Hr1LnK@O9hOVPmiMC7H5BvAW{Ct`t&P{gxRT{mlamca9AR%*n@bh2^e{S
zk@zeeYqGt@8syh^?SXL`7@W0J0(iH=S4UZk332<vS-9uAV|z*R5x|0|&Q-)~ZgF)7
zd8nNLhj))*Tugs*#hSpOUF>y_JpQE^O1OE9VnHJXmXsSi3DC{F#5=4@VmD{{AjS#2
zn7r;3M3cVF{j!(b9fpEYIjGicCWiDV+<Hz$9_yYsQqwVb!BN$)vrOO_{vnDf0>8CY
zA<+ECv{Lr~ARwfqr~}KXmNsO=wzp&)%J{qkzkaUqpfj_TbHxtZQ<UgniDUX<$UHcc
zLAX51LbOQkXtqlq)wcWmsXc9Ve3Deb<c3nH5RHt*^&Pikws5w=ik@<4Vx4MKxJ@Dv
z`jv)C9Hplc54$YSk2JM5D}?md*9L5R8TN5G;u%{ND&g@{kkp>dN0LYnNZ(~I=4Ytd
zfHlKb1_Jc}HTg2kyG|OzEGDZCc2*R?v9DZ@sKpOg&U-LdPqvti(FW8;-}+kyx>{Ng
zY!==zcDN3Z#_qs}j-gsNv@k2vb82V$Zl9jb2@My05l44s&Ixi2>F##}gk&>>|3JGN
zp1FHM>X0EHqr@m<798CM>bx68^2&SV?G{+?tdZpbh3eL|<++Hi^g*dAXgwU+Q#P)E
zWa<YZg(L-&l^EKO+9@*4RsXrwOt}<?%5lz7bWeX5O03I5#Ap_re+F<dJ!O6Jw#+~K
z%Y3PEX0L*%euI+X1B#|>rk<scgVp^zZG_IF#?~IW<1$*BS_*BVBU_F7DaAHjvXdP-
z7MKH+^2%x`rNVZyP{O%u?O0E=jBT@rqx55O=5Y!TR{ZCFs4rah`M+@icF;gz?~J%q
zvV7g>{0pj3#hJ*M*!0&+5}+V87lpY7w~tU~J{5LF#lA;-9VMLOIg^(EDYviN{>@J{
zZ8hEU{7VKQVtHLh31>OZkxLhC7Hn-E3tOwk6BM!?Hg2aYX1TH8TS{PrldIEi7-j+m
zmXAoJ`GH0DTfsY0EECG-1UUt8?`doIH14*q2)Rx_rz$Mc$y=<pS*m$j*$enr2O!eU
zU2+~op!k7NM53)YA%7uepK=;tJ*T-~`3rs3&dky{n>5|rJM~E}i;G8H>^!J#B>354
z#8%>OQDSFO#_@Tbt#vA!)qa#-U>+k3DP2*xfTfn>#@~I2PyTd8;uv$2zxub>dA4)x
z1uc*RYcZil4}5zS(hT(U^`hRr%RF|DrCHu_*zb{2GC;W_1fy2vg(QB;A76BspgGPs
zPcrqN2+yH}8Ki48(|(i|eYi4w+On$T#G21Z=#TfOkeOGksq)>7wI<5)R_#yDoKK(h
zu5TKBf;RI+re&l}PUSUiYHJM45>r3#g2z3(ywfsHIdfzfX8FhErx=?wuO+9LnEJ-c
zL(A3ibLX8QpB5OPJJhlA({-c1f2@lMd;=WAt6}JrvNCxzk1zaIPFFFhz&S(M5UumD
z$vNju;)f42tOr(Y9!;t~^s0}bre`{Bv@4%%Vfo#)fM+6{WH`o7WShOG{^cuk_CbpS
zV&Uq$K%2h;=Jy?U%LmyCHw~wLaSs|F<*2(bXK2B#?pH~EST@NoZB2M|7!O!=^hf=+
zd_d1wUcmNG6!FxhUw!A_LHAzq2uLgdbPuWRd1drTY*g~kJOI*ffAX`<$FPo2zf~}q
z+B2AYN3ez*0yl09Y$x>o{?GQ;&GQd`+236Py>rBl=L3EIP1m4Skx9Sxqa&(-7cRFu
zGQI!-1PIsc5yCq_A8^9)@y>z&LifZI?gD#AmZxnXhMI8;kU`;Ad)Yx8-a$=<j9E7T
zKB1hx3{|a$;<I{B?Q-J){5Wv)7uoD9;4x5w+56+(bNq^zjyx9H3Q(5c{)+&Df?uP!
z6F|@*jmXjVMjiPTT_A?;y*n5tE3z)D6~4P1cj)!GohL~GXKaj%$<uAGIR~2|+I1UX
zMF23Qqh$KZBgx%I><HJd&4(FO$NQ#)&32h4f3H2)egpURYM&n>100G{Q!jd1DC%EE
zV-+P7{*in7uTfDeeHuj7pYaA=qn&Vzvm6{8k!)PR8|njlq<l1pD=;yMy<Ca6uDKj~
z1C3J)QaLm`-s-yhU4k|4;HloY_sP!?P2G-OvSqt54pz6i`5jD4)BnrJg7<<8Khft*
zs%#_3+1*OIy1F3y095K~uRkaHxq_opmG-@RZKR`+)o&kJI+Hf1WitW}+6)~YpTE18
zcmA_#=H9ooJgXkNZiM1Y5{J=LZ+q9-e}xwOXU;*+@0jU?GSUiUL?G>PD)++T_1$4Q
zfE@0aKD>OHb5BFFM5yOZ-M9N*CFGjwYSSm$zKBn?;?SqA{GOM8U=)cI7JbY$(SLrF
z0IdR-`EudZ!U2Eg+4=CO`lD+@#NI%xQ<x0dT!#|XcA-r1H_{QUJ)puPzrB9SHUzbH
z5A>_Wsha#*O`E$=MJH54cfkq%^;_@xhN9|@c3-((u9^)D_*I*oe?;w${DFIm+^Ks$
z+`yW0?se}sb#~B)@%*;E+&1<-`v4YKiw~;Nj(d_!j;Mj3`OGD~XXeED|49J~mvo0=
zfI`D5LZN)P@nr9z`LfNtlUu-BiGMzre&+?1wHu1Ka^*_E_R0S;w}8f$|AokS@$w}W
zk5i<PB%ff80N|T>zN4cf>f=WN8iC=9XEF8n-=$aacLVpy=L6<CysWGOv|qsmC;tvE
znEMI?!6C&S<;g~x(WQ)wX@a~{pNbUse6N2Ud7*r-OH039!YoZK^xWywr&spFck%@U
z1o`=uW8@e*D?L8KE2(j5ve9>k+rB<gZ&TfSWjJ?N{e$#n!&=IjNY7^GV_5;ofAaCc
ztUXVzEWEPX-m#Ln4-UbFYTMWDBz0+hoWb1S3X9(ZxjuDs=m~Q!%!nO=(5;@<78Vw+
zk7_;I&Ey2A6&T|kfS;c~Yv8cxIsYyVz%(F>AD-N60X!Lf)8xYyR&T?Ba};4&*?yp?
zc<uaG>CXM^7)Ok=nWI~!DThb@Xtmw**`8l~x7gejjGMX5Muf~m0qgBI$fv(k3(lN5
zV_?~K4(M+GH>m}HI?r<U%$eK1h_c!q(t^Trk3{`I{)0kgW;+_&k#NJi3F>Ftb4d)0
zHS-?#asKJA-S{tH_h9w}zc#pU%6Y--LMmMSz}66_^zJOUFQ-L!%AOkFT7+CAuQry6
z&pZfH6)7H%PbN3P_h3eRxxfaPhGS#2#MZn8MncZP&lz6{OsxA)5(`o$cl|e9Z+`8W
zz_kig9{(?s2dd9MetZcK#egkBcK+0{@pD%RH`{`NF`I>_+}iF`m1nmB-4QX>M7_=@
zxl_7;`h~Pt8q$}qKwYlr`%zip_hH!k=`G@WP`e0A?{VRMJ5-Msw>~>*6@(uch83Lg
zII#QMy7n53$l=pPnXevAz;wsANZ|`agh=Tgm#x{k-}Snizs3*1*?>D_UmMSIAEl;j
z2AjVAoz(Z}#%&XSY_$@IGT_jAYdhS!>w7p476$OM!oH{0Sax=2mD4Cvy_<E+QApGx
zmCHKUd<f3lwsb-$JHA~3uN_19SWXI(!W$)dnOw3OtgC-Z%FI7gF_{&?j=5#eyL$bI
zJA-%RW;IQ`if+Jif-|E^9<BdMI(ie)uH>>o3zjljs}nYJTa3vzEeN<kZSD_f8*#PX
z4>O-1S=R38N;qWSxKPoxzP_m}3%}P3PV|iXo>`X?Iy0YHL`NhhCIyAy-3TvVzRY|S
z<Sv``(@pr?xoLRxr(z>yz+wctY)V7<&I?*txy*HCUc}mSG2Fs&(T%0a19kiY*hmYQ
zCEqS1|BO#{r|heh9jc~f9t)mZuur@)-B2q+kCq6Y+kAeO1KrtjNW^3Cl?x$XL{KEx
zL^92laVw@^_AD{eEV1r~MwtFgE;CEk7NCEy+*r-7VhqdRq!#TBvhEk_3?f6gWxNt?
zn&~>DD#yFsPRwo=H7F2nEH8NijkXY<q#3yJqF7}6gYo*0-h@?rT0;N8we{D`lse70
z3{HZ@I5Pq1ZyD^+otd1NfL?6qRazI38^~I2b`oY@!f!147@$mVv5;U9vGJ`saoYs6
z7L2EDYq}-VH0H9SBf+OOdr*_bj+~n0?_9fepe{|R{0e-P{}1W<dG6z|^zeU9iJRwt
z5eG7VGxg;K20Yw~9#;x1<n!LW{v%3$T!rdm<B+Upp=fm4459Nnh^kIDnAi*-C`~fb
z(DPl5h$@{voW{7OmnGHgffx5taRvDU(CrOVAxN~y#YIJB6k_sSJ)2Y|^+0ctw&K0p
zuU48cEivpdhfRZRdI8Kk6+vOSR7sV!yRgjP!_xYKjbc=j;z-*ZOm1?92T_A?i30?-
zVuWS5*(XkZYJt9<o~Iv8Zk7CY@_xE!v0P`v8KPdOLsS>KOS$ScTc@CSC30!$cD7N)
zOTCVE&+Ul3vOb#jKo22rp-S(&JK1z2RQ*<u?|Ji}L7BXHX339!ezy2h`fA2sR9#Cl
zbEz^o6#S<Xe4y^mWKj`)S3^r>7mX~CF=VeJelBFYab8GYNMC!<)fdUI6i-XD?J@|T
zUQAG`{xfQ&kFWlLltt2om}AU}#Zo;X9K@DH%mXWdrmoTFu5C=V$dL+&%G;Q%5>Ajf
zdBVt{KQ3g2hIH&)m@=8^D^F{7Bz8Ju$Rtq?S@&#?&YUbL&1ZEU+EXK5t|!9B!}+;g
zqOCAyXxo{P1;Q=8@Ok=0v1;4mb_!Un6QDmA8dRkYP$TEs4I`3x2R^QJdSF7cD{I~w
z9o}6^=|xRiz-n;zI!OV>gS`y35?uOsg-MJfr@UpDi8&l?o^YiHrm);q$2_2TLE;`?
zT~m8BiJt!B#}O|VXpCG7?jSbXW>wff;M;ErJzI~B{dgVMa8vyhU3uD%eO<EI*&x1s
zrGJIVpOTU{IB6J`ZqZWeqC&UGk+JKKV_xmZ6ER2%uupJrU!3W{g}NYynCL~8MR7vB
zr%$IBv<zloNZXA;)M$(yS{uK0Z<!UAWC7oX)Jf&0<cKLiddwo0QSX4VDuIRz$9wl|
zGiLct`un<;g8TG#)vR1>u2Z{ruZzi6rt2xBzk>F?KedO{p^AiMXhOWF#v;NDC@v^i
z+B=u3QTst+PC~7=#Spo{coeA<pp;yz6(cCp^cc8~PtJ6cd&&=M@rrGjix{Ewl^!KS
zeeV~kSg(@1RThuli@i=g$S;sKRmj|;lZQr~Wsflso*HDqyCeHHP)P8yrZ%OA7?adR
zF^GUb%e?dPC2Y9OTR#nbl4)iOenUBDyKf5JLX5vwGQAkY;MonoJk|JXyYzp?Ma-yl
zdmmW{xlre$`z^)?=!b0s1_*+jZTupY+8ax{_Dz*Ff0}nLR6+1{#a2e~#F#6cY^ME8
z4=z<YZ3z2_hK8XsxaF)$oa<bu%Q-E?Sva+4W_3p1u8i3L)m+(=ORfxBF^`E-MJ9Y6
z1VWFePV-Z;s#!`KxmSc&XF6LGV6v?JxuDHo-S-S9SGKJ2Ny37iz5QK<{|_5^D)(0I
zOm}uVnH%CzgNJyMBJ%8NMZ&QQH=q!D3m&@>mL#@NRjw|=4Z(*Ae-wudF(fAgrUFOg
zXr4M*db+WHSv{+=z?ycbDCWwRWXtI@cg{b1Dn;QC2<I5tbg&MBZ>?&dm?0QnxNyOL
z^SjVY?}VP2-%sPhFTkx<tNTQcd8#wP$I-{MGFD1KWmeinH+;YLOw&>AEDeofKpGu5
zcqm5`DO7$%sfL%F5dk<YAgA37UwN3FxH@r;$igmbDCa|Q8=cYai?431q&l@I=EV4W
zR+>~;jjoRL8aIE3cnmjCqJOH*_m*kI;qG$ExO((hHWAVJhsAMN^BhU7>$eO<3|hkm
z-8NUl@m<A>5@hpPub#hfOO5if!(}N_RC>!wds&|gSJQS%3%u2_V{$h23`gd+=KR3z
z@LS=PxwOOH9Wfb+nIPhPaFDI$<%+?etkhNb%nfDbAjc=$oXacCt~8np1zkx_i2~HA
zH>V@6GB#+BziyKpr895gOtK#&IVIr_&;5P2`w!>T-->?WmgeVQQKxfA26ughg1XCf
zj)m&@S4*e0ln3A?De6kT+mjaCnG{?Lc1f7-+H8y`{jH~GYLaeXjJ6<JrJ@s4pqoC6
za+Oq<ukh!{j-@Ea5S&w3Q#(0;K29!{maN#O^Q}w|L=VROCUYX79(P&?)FspneQ~We
zKU-=29&aPi=z=_SdWJ5Mnw36RhBqS_M8~HYM%zZ|7Y12T{8p^-HBji3CB154E@F^D
zxx8iS*yGy098MBr?l=?i!OM{<eZ8Bx7YmE-CtbOy+Q&sv($nwg1o7h7rIDh}MXWl=
z8lWj2HTOmMg-Awzh$ZtB_BySzCH|2)8lDAl8m5c15L3>C$@hENlA-FwV>xO5)6;Su
zo-M@QeCR~Mq=3Uuxs*X$R$^R4sK=TOi|yLQi^9@k<}G1~SsrmRZY&2YL5Nel?lER&
z1Ji&&Amz{F;qi>1h`zS9NF1&|xjNrxxRx&@Dyj){aT+~|f7B&QUHg%2EPlyFyIO(B
z<cxP)Hl&`qM1zgVuW<BcJV)ELnO>gY+_x>L%=Vvl9dNkG2Oh4xtZVUtC&m^ORM(>u
zb9*;%=Zb9mwqH?^gL#c!Ap<s+Mp_0BN(9gouzN=+&ZR|6-~2?+&jwM&S-8h+E<tEh
zMHI8w_KE}wJ;9H{4&rm+WBLcX=Dv*%*yFwoR?{d5WAy*k-j#<#+4gN&l0B6@OFSMT
zgpd%jBnm0UzC5<96O$#w2#K;x3Y8@xvNMq}%-HvBWE<<qo_!sIF?@Hu&vAU;`#gD%
z_dAa7kMEDyA9FbFV~)A6`@VkHb^WgE{GI1n2ZwK1!EwcXN%AAkULbID8OQEO`2_jk
zW;Myeh0kJp04iQrjyyeFzjfe*hZ6cc<}e8uRQA?*(MQ9*BTRyAizwg@5NZROa_o-q
zL@y2&6;-Q@RJZ{(VMy}Pc$snEg!xCUw7^dc*y~zBQ0sZ!MF%hd3m1}&^UN@>^6nSq
zWXJG`Ed~oal)I0o$71*gNAEpDAz9E)bpa99EGQbcD4DIpOr*A$pz;{+DpD0x_38>g
z_VFzjmxTbYWu78ULxO99<?sjoV6!+OH2>ZVud8n_qPiM=w1MMR@TeB7Zy2MBm;e<R
zlLk5RA)_5u{zrQ_J;Ky$zlxQ@>?6mOlkL#yI+#Mh)cLHePj0rwJHYh#w%l_95WRv_
z$86N{j<fNxmjfz(Jv%@F8Q>m3zW#Y@IE)vXS&R2X(2A>!*kl@gH4}#ZLh7Y9PVmS6
zN{F|0GH8rtIw9_Sep#wpeD#8bv1r2NqQlKc2RAOnImRPk&wCRcx=zM^KZr@rN<#;h
z-+-N8e9hDhQ1ge%SG;PHV>~W6ttNu}!9G16&pr=)FBj+sIICry6|BTP=C~^NSYikV
z-Z{<7s(-X^g2t^hf|!4}hfBEkZo4-u&qg8tBn$>%OqgMOd1`{f#RtLS9`>@B!Yfg7
z`8D{XYSwCi&`Sxp)q*Q_rp~7sz+56NM0YaE$v(J3UZ0hO`T5b}j~^Ynl86W=EJ+h0
z!b0exwz*6;1BD9LI9)i>n|21sI^!T%^Qe6BXT@Row2DLP^?T#jZ7O!%nE2%yXja)>
zEw-HN%&|L#&kgc*vo<|zkQ}fgcw*pM`*vp%(v(5<P<z^@0vk@U2_)t7am!2I^aqcc
zp?-J6XLP{Ff?i8rlX6ozAujxAPpd0v63`twD01dQbp-)B)c0&)Ln@~bi2%fnJim;F
zk3qJsr{Ei2EdwJj4Hpzo{vdu>Zbp6$iDwjB^a~~bZNyQ8*!~m|V`TsaoL6(Wk#|A;
zjgO~E{KZyRwBvlbyZ0~3snbWjy5W)dF#AmQ7eh^_6mXv{<4@6lEpKQs&!%O`0MH?g
zoi1J6sDKR?X5J-s+b`>T<;g|3ZYwX>(Jk2g`qyM3t5iZl{$M_KykUF|okZm8r!v4S
z?$luXpkDwV?2O!S%$+D;gXiq@JyGddo_?Y0;&5)3D_|aPyma`(9{JIIf|z3EOVD>$
z*;0m);7y)2K%ofq9Y0zr_WLzmz-Jl)7WbE3vk4{%acHU%)c8S(P6uUsMT~$j!%duu
zu2gi8hU!tJksp5Ku83S-F;jB6n1n<_*KbF_3fBL9D0AE$5cIH0SBFRUj=qjS8A$=2
z4IxTZB=$2qk`7>_7gg0~;rYeUowpUJg7?~k=>bWT4R^%256>aQXU@RAzgFcfr>s|O
zzBE`k9u2Tx4;S^YCh%C?1B1ZO_b{(KNyVc_Am$d=Ba7T5I}Oi);89<f-Htx1z074t
z2vD$q=VA6O9<jI(rFwK1i&oaafZeS=uH#9bLk;xMq0dU5aCwj6)oNPniy41*Z`nf4
zO1lo$a3yKLfkmH>PaYprBcbmOJ`J!ZuQB}M9MrJ)XNCDwDoHe4w76AYFC`jj>*1M=
z;rjXl?f*2xHMQtvNn`<BR<>+@{??0qvg1XIZos5oHCShVejG@+hG^W@g51k2Zp-;y
zJXgF0$f^)3Jbp(d$eEF`+Qf}$5dXbGZZkV1P{uN0fdZhk!9fw5gXOA2fH=PVI7-f`
z*Ag^M>Se$_EG_bDTJ_4(r5^?G6I{{6$M;CpSy%ih51Wa$(@>6!BxAW#(BsWR{52q5
z1p0j<dLeXY0wHb!S5f+k>?u~6@rN9W0HfE*LscOl8-g56CkXG`wh;q1+Cl&^|EG-@
zZj}uQ%+ZEIb+!MAvaZ#`%__%LV)+VFp_H#1i)peVQR7bV78MZ;&HoTEpu0Lzp5svi
zP5YWHp)`hNFJr05N{#g}6lwVqAiGwI)x@gsL8s2j1xzKIZ?_Sv;Um_4_2GNvIz>48
zvp};?ZgB)n`l^s;w7I=O21uPk34K!I)@z5--a<2v-8g&aS%5n$--oySh?|Gau<Mp1
z%4`pE783>*DmyHPQ`TSy4aA;$zIw|5@=CQA0{AH7+Vhnf3CkPa;&5v(2w(Ldywu2l
z?IZX-en1S==|=(*qqH}L{V&s}#}F%rN?#VdDoN#%t0QZin;B5GX^C!&p*5P(U$BJg
ze)@c7vOSy($}SU@A86|r<&P7J#C9i?DOf$f_>R7?*OcobU3;|Er%mbf7m=sB(ko>p
z?_A`1muDhxnLg~i#(#rU|CDH5xVeRO%@$c*N_CdPtXJ<{1Pq8E;hT<x^$+hALst!|
zcW=SrZ@<UdsXGv3L2iT*ru~O)ETm2}@}+;{Tim$&qvB!d2~J`~z8g$5nb71^Gulb$
z=}DPhFi@rcA?4rNT426vVlkflc#Rjgh<hW(wjeI|niR<XWHcjhP@(vDw1>T2F%5RM
zJs$rl%4FnsMPUhSucExHikRT$hyMG-eUo%|F5=~nq7u*#9%Ow3Z080=tx~qiWzn-|
zSBQ^0o13?7B`Dl3z}y2vs}vv;X^$Us0A-CLqrT4WDPr;BOYC0>N#ja(7t(1R3tq^`
zFNgh8qWSaC`TUO)e2v^xEQ(SRE%os^jmL!xCZJC*mH6tr7=X~I|1_Q51(AL3q3vbe
z1=@lQ3CI<I^bpV~V~lQ=a@c)_&wk6%KC-D~x_XHZV<>SGN8Of+;btwS5S9zzIQ`iH
z6D%*DW5HJV!6))Sh?M%9_N-r2E1x>|llp_aSrP%@r4<uD@zStJNiyHp)gfvHS-i!A
zD@3|Y^Ag{hRNJugz&`8o#ObHRz`K865>8Ox{;~aErK%@Q@lylPTZIZ;k{lQjTWDh;
z(XApk5zC6_Pmvz2wnvJYh`!0Z(q5<Nz0TL9yEbG_TRwN<pNdExwCD6wP_TR4(p10y
z=dHfA{)7V&KY>kvOH4$Hn1GcfB&;0UX9}uT*A9<!GCy_hXXFxT0iHNZeI4^!R87lq
z1gF@4l&u8)d<Nj-SfSg8KSWtr-aE#@HT`WIuGRSch9)MzVEQ$ZDM0b#sM+qcj7)q|
zQeI=Drm^Xx@J;$8Sv<yCSMP_FyB$Y;CfkU&{%PM7$zO~;;3%p#PV8rDw1({@b=tIu
zLRP8(@Az*^H+0B}^e%%^|0a%FNfF%e2LPigIZb}0&xO$a-&nu{K=NsUwY77A&QE;&
z$4v$)Z0Q{NFt+a3$J;;RQ21tTJ!vTa`u+b2q;mWfNR=Y0>xEm(-J^#y|7+&9;LF61
z(c!6Veoa+Becu6+-f3*cYVx~x3-zR#8Ha>JugDwush0-8X8jEa{^K#6zrZBnL|`+m
z{#Z+01&|(rCI|hf6z}8>7TsS`VhiZ)GD_8Z8^Rxt6gt-W`-Q+ufDLY15IrFxx{$(g
z&S*~)C;+cC14!0d>&iV=fYp*JK!DS|b0@)9611JS&^ws+aeIbJMVa*LH~?l6>M%9a
z`1>nYgn9dn^ZJJdDp?p9AayE}WIOKK<rCEjJqUpb0P<4(x18Tq0sHHrFsMDl;%7yC
z1ymga(vJ9ccslTZ;rw12vAYBQSI+M@WB+u1pW*xI{I2*P=lB0UJpH$v-~Zq6$Nz(F
z|MT3Tb_*!Ck!s8AIG#yQodujL88Y)6J4c+}tpN)5BwM!NRJ+dRj^9htgy&NfA`~Uu
z_3gV8PYHXA&c2-KcX;~po>{bE@AH|L_aYS?I$e0W;7pK|S$C%wuygMwmMV9u)(Dz4
z0ePQt=OH!L)>2rqC6QoBBvl^mkAWuguQFUlOLdoaKr<<5MAc5v8$O{t_u()9h6rA)
zU9Z;B=b^px>o5Gg+GO@*GRW(_6`tqVA38yQ?$(KCL@n=;s}Fv8r+@ssXg4L}TGZC^
zCjPh<0pI(eLl3n4RbR9Ey<ar>&vvSLvD^CFq&UAJYX5oVFOLRXRimYZ!C>p#+fPv_
z6mx*{n;TCiRnn;bMf-YmYez=R%MEmNY@ZY-Sg!KOqOq8SZu9J{tZB1m+2I;>I;wav
zLSi>8iud@&wHB)x8J*F50(Nw4qEM}QJ8W5un<V3C;gj=QZ>(=k&rO}Ox3}j-xcTyw
zT&A{JQ4}yRDb0&+?Ww)7XLWe$*q0oFrcb#Z#LcVZ>+mEERC~UtZ)qJr4x#V1L2v42
zWJMhq)>x-f+OaU%Fd!<e&)?z3-Ap#=lG}Imw-M-Ee){+B|HqpXbvSWyw~`7sx_(_n
zh1bf1)>&N1wb6Encvz-3165=MRCQh~=htW$F#7QV(W2%sOm|!p*9{mh*W$VuzkB!x
z?~G|h^Qqo3=3VZmrL*C$D;)KkMU@v?*v^&F(PSJ}J|*75dDhoY*@zNM4&4?-L_XCz
zH&gEJN8eP8`b;x*|8(kiSIgX7xU|cn<?Ri=7+tmwjz+^_+GFnhB8GzMAT&)E!?dR0
z8QZei^T7C#v*o#ZA)I|j`S@nasfuZ&_Ed}l-f+~i@<9A>YZr0g?rL;WE)Qf}Qx!y#
zT*X&Osq$3sWnV&ViOR8oV5nysXPxs_M!t|wsX!kkrisTRpExQqI7lRy_5@$kKX}Nk
z03Hv|b#dv>HKt-(tjU*V_uvmtMy}d^=rFBd^nK!gH+{uxbzU#W^y`^9r|ivMXw5`K
zSf6MCv&~bn1aa3<tB@~J1zuUoflsY>JWnw&t95ak(8$AlHGdt_Ayb026g9TaM&Jh0
zLMf%!?su=;T=z3o;3K<ECeu9n7EKBDCi=w1`3-#O!^Lg0J=AOjziszzFhS`q4raA1
zzh_2$H04-}0H2**++JoD*1?{~JLAeVNP}-@<jw$4^5XzXK~T#d7J;E?->phpPEO7T
z1Mt^doTx?1VcKs#fFOjMCF9zc0L!7bzl<g|0~#6H-5(ANd4`vfg>NRwQ5;gX_Vb}F
z2Jdy6_~cVB*Yz=F6hv>8)acFLPF7}5D|5@$J$gNf;nW=5nAu@%ZS{|>rW%`6v7@GB
zFRGovYNu;$H80LKs9bM3r63a6GZREe@kf2Fbd=o#_x3-&3fZCT?Ci94HKNyuxS9dO
zjCjwI8|j1)&THzH)vunKNF>)~Lus$LujBPJNYm;v%|Y^1d_pO#Y`jsx8G8C8$!Ai|
z^Xkqr=_GWAw{dGeI79Cf{43JW?@O71w)ROulcx4p+6HNk9|msTnY`{Upc{X=6<5(1
zl@w#)J2ls(lw+PHn6f|G1~radQt-5E`>Ye0Ku!=#h_J#IojS#60>Vdq*0VsasZX_~
zt(T+d76%GrSc~*8%gME^l$G!v7tE;?4W!UyBMjqO!WkL*OynD-N*~V%!2j<oZzTcb
zvl8Ib!09)y96=P^jj^txnc!8;-Lc!yH~X@z+hSmzsX;Q~c7$j)Bn=cAX6b63SM|~j
zsuSo&J{aWOayA$Y*lDt%=-jY*;gMX=ig2a!97D&L^<ny9BYq1asz{dsOBE4HvSjK=
z1_&;BHF)yH7{A)pfxNp+iL>p3<b``&_^2A0hmT6M$dx`N_PFbo=tpc*QtY4k+I53A
zC~ZsbflU*kv>l)VZSPGDuJ^=Jq?Wlk_W@Oy^jH@idBww#L%l-?2w%DiMz1G`IM({i
z!D)=2TYC*<>rw@CAcV1WPBKx-!~9E0bBIRE48v0zNRTaAT|*hV!?>f*mvgU*JB4;+
zdKtwKIb34pdF@jBT%?S;FLT38)X9ytRWNbgt(S?ByGO|;E2iwdsr7NIA5Q0qBZS^p
zW?Ke*wEs<dx67hH_gTax!zCP))Y<gBv2Rm}H6tRNI%lQK>T$8<TO5;HUvIB;a|g#8
zNt*<#=igN2olt`YPvBsRJd@ntKscK{VLH!M{7{)ZHDJUlLD~<V3`(;ek9+?<wx~P|
z@hEOW50IdHjLLMI_x;R2o2Ap=u4ZanSRk!0j3&ODq1))aaem1jX|Lta7)t4!t{w(V
znYps;9~|0Vz1>HN7~Q+~H4~n1IX;2WgYJ=IQ|U}A9E5#6V?smJpDV}cq2G#vUD7uw
z8{A%{EvxnfbH~DxMO#=AQw;ZuO|;%~2q!k$2t}?}duMHK`pLremTpbb{4FQ=b5YQy
zWL#x{$q;1F9Qmk(7#A9s`l2tcO#XL!9S4%S^2&0oq)gsKWtKERH<E2mhTB^lSo<i`
z?zs0XUff;52W|6Q)jhc^7|AXicEhBouGNm}YcZH*7zC>)^*C<btupcPxt&ogHD@p&
zS|?O}|HswC9IN~!_u%iX#C3v2Bxb{{-~3R#{tp4&!Or*6cdN@zt5*#bAa5`9ZYIsl
zoJ*<kr-@4s@otz{wia_xC<1VjZ?B7DIj1Knl}3veE9?hb>{j-#qCg=-oma&I&icAP
zS9^X&*dZAhj5qpmAo&6|5>I3hv*vRF(sg-n7V4}*le3M@$Gwgz;C1-Oh6Hfot75jB
z6Y_5vZDX#<IT{w6pMV`vQF0XDSCumV7S+tO)P_CM^p{%v9JMLaj(|e1M90K<ldlw*
zA=#GX-CxTMCrlGb!QU48oK4T7Oo1v3V}I2lpYs7b-=kAZ@WsqFzjd^V-UQsr=XM0q
z#3Mn|lXLBHif9g>SuGSF$ob}dQ5*f~_sI%w)Iu5!?hT~n=7EoQgUq;Z^^YJI2Gv&}
zkTFS3&8Bul!T9Njp{}aa96U*F%O{p;qwfP<6`nI%bJ3H-w{cBlTAP3XLZoAEX1~or
z<CjTM$do|sH*3Gr9KT8Obc?}y?)ZeyG9-g{^%@14H=y0=o!+8Dp{kULUDUwP)M;^o
zEN$;&iDaSuk#c*MYD?~PW(aX-;Ih1Yx69Bb^lrn1SI+~+@3^xV_o^IRB=^eH!5fCa
zuQ_%qfg>GU4bOH!qaQ!1YJo=8IajXF1W%G}(h_zugdBx2k_}Kqn+JajE9a8*efxv<
z7}4o|UrT#Tpq-1$g{3+12+`M&qeCic+ODQUs+-c#!!z!Y*3Z0W@o{&$Q&1EJ#S7e%
z81EG+P;s5ljAqQ|8>l1!`Ha6Oj6c#%HCA@phsC39eO2p+{qXtAu&GYV{1@J$5T}5S
zozi()yQ2`H&7(h>s!s(Z2q7minV7-?m9)K6rktV0JLg}1$}=-g6t;^OQk@K%Vp08L
zDqb;il=GzQy|XbB=cEKXyE-p7jcOcfsgJzAa(jm_COVoia^SFv$OrU}SNg77xHi*L
zebBDJFg9%F9LlZ`c=Qb=+4)QL!;m-M=B6UE@8I9ex_ORQW)2QxJ1QD6&ttrr^g>J|
z3OBkY*ASN+*y8ueaK5bi@?!BHnG3KgemmrE^UfTTb(YGJTVvr>jGgP^&g{1kj`QCX
zx&3ZcDvfr-a{aG6gFiD6H7^d}ZIHMItJbaKHO;sXlDN-*umv3q>X<QWQKOT~SB;9T
zs>E~>A&=JuXzIi>5kNAsXEm5W%%JWf@E~XXJS>p4oi1muz-&O1n4x%3K{b)Ub<|7d
zQ{GNxZ1!_!Zdp+xmdJRgR^A1FV)lqjc@@f%te~~_K6oIUBl$qmj4wPs{+xgG`B3<1
z*~`hGM~#1=Lh`+5?#qinpa{C<1DX!Gj=85T-}VVLuJ|Yo>IL<>yLlca4d__6@#dAG
z5@~BZ{Ay#zi46{R-SL2pDf{vxBLZpCQ{VJ#DUEuRQ+nWIhG?#}{6y<KBNU~3rQcHx
z{$xv4kh{(?Sy;v;TMrM3h_sh4DIk!oj6m_?l_7#8I!(EYA6SPkiZph1GV)}EStq5e
zY>-Nnub8XUh`F-@3q&M_#A0V%D-*LLm=k<3)225s^QLPfX(r<Jr|uk&M!9F&+UuOs
zr&6z#g%s68J<=-s`|opdaW%BIt|z>C!Exf^MYye}r}_6U<7ukFu`@FfqW7}5_2iDW
zWQ*b>;6M)a`zVQZB02sdxxMQFe^xf76vf%sG9yN%D#xW6Wlz%5_?1;uxW<+qvJ=G6
z!5dRF?#q__C06lT8w4)mnKkUZlzqP`KjC2JIp6m&goI|rcqZH}wlB_SHfZpUa{{v_
z9XG<91f+%#w6y#&QS@V^h1_86$zQkb*Yoq{%d8jU`RtTnB7eiUoA_l(Qm-j;dZq?z
zJBSu`Rb=zhkG~@=bH%75Cz6fqg-CZr0=ocKb`<mI6w&pdzvlw^@&h&SB}V#&*xjJb
zDj>%>&3@)Xd58HH41B=N$z2`b7?`dseZcz5Iqe^v+JmYMK4JegRLunX+YSZrcS}oO
Kv*?Cx=zjr;x-ZTE

literal 0
HcmV?d00001


From 25fc3a9e95f3b05ce19986b8c80c66321a2a038b Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Tue, 20 Jul 2021 17:38:54 +0200
Subject: [PATCH 03/28] Add RateLimits

---
 gloo-edge/gloo-edge/README.md | 231 ++++++++++++++++++++++++++--------
 1 file changed, 180 insertions(+), 51 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 1da30b6cb2..52048ff451 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -200,7 +200,7 @@ It should return the discovered upstream with an `Accepted` status:
 
 Now that your two Upstream CR have been created, you need to create the resources to route the traffic to them.
 
-First, you create a Virtual Service. For bookinfo under `/` and for httpbin under `/secured`.
+First, you create a Virtual Service. For bookinfo under `/` and for httpbin under `/not-secured`.
 
 Please, notice that the oder matters.
 
@@ -216,15 +216,6 @@ spec:
     domains:
       - '*'
     routes:
-      - matchers:
-          - prefix: /secured
-        routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-        options:
-          prefixRewrite: '/'
       - matchers:
           - prefix: /
         routeAction:
@@ -247,13 +238,48 @@ It should return the bookinfo application webpage. Note that the review stars ar
 
 ![Bookinfo Web Interface](images/1.png)
 
+Now, let's enable the httpbin route to be matched before bookinfo:
+
+```bash
+kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: demo
+  namespace: gloo-system
+spec:
+  virtualHost:
+    domains:
+      - '*'
+    routes:
+# ------------- Another route which is parsed before ------------------
+      - matchers:
+          - prefix: /not-secured
+        routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+        options:
+          prefixRewrite: '/'
+# ----------------------------------------------------------------------
+      - matchers:
+          - prefix: /
+        routeAction:
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
+EOF
+```
+
 And to access the httpbin application:
 
 ```
-/opt/google/chrome/chrome $(glooctl proxy url)/secured/get
+/opt/google/chrome/chrome $(glooctl proxy url)/not-secured/get
 ```
 
-It should return the a json object with details regarding the request:
+It should return the a json object with details regarding your own request. Something similar to:
 
 ```
 {
@@ -267,7 +293,7 @@ It should return the a json object with details regarding the request:
     "Upgrade-Insecure-Requests": "1",
     "User-Agent": "xxxx",
     "X-Envoy-Expected-Rq-Timeout-Ms": "15000",
-    "X-Envoy-Original-Path": "/secured/get"
+    "X-Envoy-Original-Path": "/not-secured/get"
   },
   "origin": "x.x.x.x",
   "url": "http://x.x.x.x/get"
@@ -300,7 +326,7 @@ metadata:
 spec:
   routes:
     - matchers:
-        - prefix: /secured
+        - prefix: /not-secured
       options:
         prefixRewrite: '/'
       routeAction:
@@ -327,7 +353,7 @@ spec:
       - '*'
     routes:
       - matchers:
-          - prefix: /secured
+          - prefix: /not-secured
 # -------------Delegation by reference------------------
         delegateAction:
           ref:
@@ -364,7 +390,7 @@ metadata:
 spec:
   routes:
     - matchers:
-        - prefix: /secured
+        - prefix: /not-secured
       options:
         prefixRewrite: '/'
       routeAction:
@@ -386,7 +412,7 @@ spec:
       - '*'
     routes:
       - matchers:
-          - prefix: /secured
+          - prefix: /not-secured
 # -------------Delegation by label selector ------------
         delegateAction:
           selector:
@@ -445,10 +471,18 @@ spec:
     domains:
       - '*'
     routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
       - matchers:
           - prefix: /
         routeAction:
-        # ----------------------- Multi Destination ----------------------
+# ----------------------- Multi Destination ---------------------------
             multi:
                 destinations:
                 - weight: 5
@@ -461,10 +495,11 @@ spec:
                       upstream:
                           name: bookinfo-beta-productpage-9080
                           namespace: gloo-system
+# ----------------------------------------------------------------------
 EOF
 ```
 
-We should see either the black star reviews (v2) or the new red star reviews (v3) when refreshing the page.
+We should see either the **black** star reviews (v2) or the new **red** star reviews (v3) when refreshing the page.
 
 ![Bookinfo Web Interface](images/2.png)
 
@@ -511,6 +546,14 @@ spec:
     domains:
       - '*'
     routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
       - matchers:
           - prefix: /
         routeAction:
@@ -552,17 +595,6 @@ Let's start by installing Keycloak:
 kubectl create -f https://raw.githubusercontent.com/keycloak/keycloak-quickstarts/12.0.4/kubernetes-examples/keycloak.yaml
 kubectl rollout status deploy/keycloak
 ```
-**Troubleshooting Tip**
-
-Make sure that the KeyCloak deployment worked correctly by executing the following.
-
-`kubectl describe pod keycloak`
-
-If you see an issue with the readiness probe failing, then you will want to edit the deployment and add the following values under the readinessProbe.
-
-`kubectl patch deployment keycloak --type='json' -p='[{"op": "replace", "path": "/spec/template/spec/containers/0/readinessProbe/timeoutSeconds", "value":10}]'`
-
-`kubectl patch deployment keycloak --type='json' -p='[{"op": "add", "path": "/spec/template/spec/containers/0/readinessProbe/initialDelaySeconds", "value":10 }]'`
 
 <!--bash
 sleep 30
@@ -576,6 +608,8 @@ Then, we need to configure it and create two users:
 - User2 credentials: `user2/password`
   Email: user2@example.com
 
+> **Note:** One of the following commands retrieves a token which expires quite soon. If you get a *Not Authorized* error, please, re-run the second command to retrieve another token (the one starting with `KEYCLOAK_TOKEN=`)
+
 ```bash
 # Get Keycloak URL and token
 KEYCLOAK_URL=http://$(kubectl get service keycloak -o jsonpath='{.status.loadBalancer.ingress[0].ip}'):8080/auth
@@ -635,7 +669,7 @@ spec:
 EOF
 ```
 
-Finally we activate the authentication on the Virtual Service by referencing the AuthConfig:
+Finally we activate the authentication on the Route Table by referencing the AuthConfig:
 
 ```bash
 kubectl apply -f - <<EOF
@@ -650,18 +684,26 @@ spec:
       name: upstream-tls
       namespace: gloo-system  
   virtualHost:
-# ------------------- OIDC -------------------
-    options:
-      extauth:
-        configRef:
-          name: keycloak-oauth
-          namespace: gloo-system
-#---------------------------------------------          
     domains:
       - '*'
     routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
       - matchers:
           - prefix: /
+# ------------------- OIDC -------------------
+        options:
+          extauth:
+            configRef:
+              name: keycloak-oauth
+              namespace: gloo-system
+# --------------------------------------------
         routeAction:
             multi:
                 destinations:
@@ -675,20 +717,25 @@ spec:
                       upstream:
                           name: bookinfo-beta-productpage-9080
                           namespace: gloo-system
+
 EOF
 ```
 
-To test the authentication, refresh the web browser.
+To test the authentication, try to access httpbin application. You will see that Authentication is not required.
+
+On the other hand, if you refresh the web browser for the bookinfo application, you will be redirected to the authentication challenge.
 
 If you login as the `user1` user with the password `password`, Gloo should redirect you to the application.
 
 ![Keycloak Authentication Dialog](images/3.png)
 
+
+
 ### Rate Limiting
 
 In this step, we are going to use rate limiting to protect our demo application.
 
-To enable rate limiting on our Virtual Service, we will first create a RateLimitConfig CRD:
+To enable rate limiting on our Virtual Service, we will first create a RateLimitConfig CR:
 
 ```bash
 kubectl apply -f - << EOF
@@ -727,22 +774,30 @@ spec:
       name: upstream-tls
       namespace: gloo-system  
   virtualHost:
-    options:
-      extauth:
-        configRef:
-          name: keycloak-oauth
-          namespace: gloo-system
-# ---------------- Rate limit config ------------------
-      rateLimitConfigs:
-        refs:
-        - name: global-limit
-          namespace: gloo-system
-#------------------------------------------------------
     domains:
       - '*'
     routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
       - matchers:
           - prefix: /
+        options:
+          extauth:
+            configRef:
+              name: keycloak-oauth
+              namespace: gloo-system
+# ---------------- Rate limit config ------------------
+          rateLimitConfigs:
+            refs:
+            - name: global-limit
+              namespace: gloo-system
+#------------------------------------------------------
         routeAction:
             multi:
                 destinations:
@@ -763,6 +818,80 @@ To test rate limiting, refresh the browser until you see a 429 message.
 
 ![Browser 429 Too Many Requests Interface](images/4.png)
 
+
+### Rate Limiting For Authenticated Users
+
+Now, let's change the Rate Limit to be only applied for Authenticated Users. But this time, you will apply the changes directly in the Virtual Service.
+
+First, let's delete the Rate Limit Configuration you have created before:
+
+```bash
+kubectl delete ratelimitconfig global-limit -n gloo-system
+```
+
+And now, let's update your Virtual Service to add the Rate Limit Configuration directly in there:
+
+```bash
+kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: demo
+  namespace: gloo-system
+spec:
+  sslConfig:
+    secretRef:
+      name: upstream-tls
+      namespace: gloo-system  
+  virtualHost:
+    domains:
+      - '*'
+    options:
+# -------- Rate limit config by authenticated and anonymous -------
+      ratelimitBasic:
+        anonymousLimits:
+          requestsPerUnit: 10
+          unit: MINUTE
+        authorizedLimits:
+          requestsPerUnit: 5
+          unit: MINUTE
+#-------------------------------------------------------------------
+    routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
+      - matchers:
+          - prefix: /
+        options:
+          extauth:
+            configRef:
+              name: keycloak-oauth
+              namespace: gloo-system
+        routeAction:
+            multi:
+                destinations:
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-productpage-9080
+                          namespace: gloo-system
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-beta-productpage-9080
+                          namespace: gloo-system
+EOF
+```
+
+Refresh the httpbin application and after 10 times, you will retrieve a 429 error. This is because you are an anonymous user. 
+
+Try it with the bookinfo application, and the number of requests will be limited to 5 as you are an Authenticated user. Notice that the requests for static content also counts.
+
 ### Web Application Firewall (WAF)
 
 A web application firewall (WAF) protects web applications by monitoring, filtering and blocking potentially harmful traffic and attacks that can overtake or exploit them.

From 936129469dea81d2acd8e2757741d7bee8fc9d5e Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Tue, 20 Jul 2021 18:50:34 +0200
Subject: [PATCH 04/28] Add WAF

---
 gloo-edge/gloo-edge/README.md | 146 +++++++++++++++++++++++++++++-----
 1 file changed, 126 insertions(+), 20 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 52048ff451..fa5133e56b 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -850,12 +850,12 @@ spec:
 # -------- Rate limit config by authenticated and anonymous -------
       ratelimitBasic:
         anonymousLimits:
-          requestsPerUnit: 10
+          requestsPerUnit: 5
           unit: MINUTE
         authorizedLimits:
-          requestsPerUnit: 5
+          requestsPerUnit: 20
           unit: MINUTE
-#-------------------------------------------------------------------
+# -----------------------------------------------------------------
     routes:
       - matchers:
           - prefix: /not-secured
@@ -888,9 +888,17 @@ spec:
 EOF
 ```
 
-Refresh the httpbin application and after 10 times, you will retrieve a 429 error. This is because you are an anonymous user. 
+Refresh the httpbin application and after 5 times, you will retrieve a 429 error. This is because you are an anonymous user.
+
+```
+/opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/get
+```
 
-Try it with the bookinfo application, and the number of requests will be limited to 5 as you are an Authenticated user. Notice that the requests for static content also counts.
+Try it with the bookinfo application, and the number of requests will be limited to 20 as you are an Authenticated user. Notice that the requests for static content also counts.
+
+```
+/opt/google/chrome/chrome $(glooctl proxy url --port https)/productpage
+```
 
 ### Web Application Firewall (WAF)
 
@@ -898,7 +906,7 @@ A web application firewall (WAF) protects web applications by monitoring, filter
 
 Gloo Edge Enterprise includes the ability to enable the ModSecurity Web Application Firewall for any incoming and outgoing HTTP connections. 
 
-Let's update our Virtual Service to restrict the characters allowed for usernames.
+Let's update the Virtual Service to restrict requests with huge payload to avoid Large Payload Post DDoS Attack. The intention of this DDoS attack is abuse on the amount of memory to decode the payload
 
 ```bash
 kubectl apply -f - <<EOF
@@ -913,29 +921,123 @@ spec:
       name: upstream-tls
       namespace: gloo-system  
   virtualHost:
+    domains:
+      - '*'
     options:
-      extauth:
-        configRef:
-          name: keycloak-oauth
-          namespace: gloo-system
-      rateLimitConfigs:
-        refs:
-        - name: global-limit
-          namespace: gloo-system
+      ratelimitBasic:
+        anonymousLimits:
+          requestsPerUnit: 5
+          unit: MINUTE
+        authorizedLimits:
+          requestsPerUnit: 20
+          unit: MINUTE
 # ---------------- Web Application Firewall -----------
       waf:
-        customInterventionMessage: 'Username should only contain letters'
+        customInterventionMessage: "Payload sizes above 1KB not allowed"
         ruleSets:
         - ruleStr: |
-            # Turn rule engine on
             SecRuleEngine On
-            SecRule ARGS:/username/ "[^a-zA-Z]" "t:none,phase:2,deny,id:6,log,msg:'allow only letters in username'"
+            SecRequestBodyLimit 1
+            SecRequestBodyLimitAction Reject
 #------------------------------------------------------
+    routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
+      - matchers:
+          - prefix: /
+        options:
+          extauth:
+            configRef:
+              name: keycloak-oauth
+              namespace: gloo-system
+        routeAction:
+            multi:
+                destinations:
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-productpage-9080
+                          namespace: gloo-system
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-beta-productpage-9080
+                          namespace: gloo-system
+EOF
+```
+
+The rule means that a body's size cannot be greater than 1KB.
+
+Run following command to test it:
+
+```
+curl -k $(glooctl proxy url --port https)/not-secured/post -d "<note><heading>Reminder</heading><body>are you sure this is a huge payload???</body></note>" -H "Content-Type: application/xml"
+```
+
+You should get the following error message:
+
+```
+Payload sizes above 1KB not allowed
+```
+
+
+#### WAF Block well-known User-Agents
+
+Another kind of attack is done by some recognized User-Agents
+
+```bash
+kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: demo
+  namespace: gloo-system
+spec:
+  sslConfig:
+    secretRef:
+      name: upstream-tls
+      namespace: gloo-system  
+  virtualHost:
     domains:
       - '*'
+    options:
+      ratelimitBasic:
+        anonymousLimits:
+          requestsPerUnit: 5
+          unit: MINUTE
+        authorizedLimits:
+          requestsPerUnit: 20
+          unit: MINUTE
+# -------- Web Application Firewall - Check User-Agent  -----------
+      waf:
+        customInterventionMessage: "Blocked Scammer"
+        ruleSets:
+        - ruleStr: |
+            SecRuleEngine On
+            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
+#-------------------------------------------------------------------
     routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
       - matchers:
           - prefix: /
+        options:
+          extauth:
+            configRef:
+              name: keycloak-oauth
+              namespace: gloo-system
         routeAction:
             multi:
                 destinations:
@@ -952,14 +1054,18 @@ spec:
 EOF
 ```
 
-The rule means that a username can only contain letters.
+The rule means an well known scammer User-Agent will be blocked.
 
-Click on the `Sign in` button and try to login with a user named `user1` (the password doesn't matter).
+Run following command to test it:
+
+```
+curl -k https://34.141.86.2/not-secured/get -H "Content-Type: application/xml" -H 'User-Agent: scammer'
+```
 
 You should get the following error message:
 
 ```
-Username should only contain letters
+Blocked Scammer
 ```
 
 ## Lab 3: Data Transformation

From 6ac9daa18aab5b047600cb647c68010e770ff6c8 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Wed, 21 Jul 2021 16:33:53 +0200
Subject: [PATCH 05/28] Add transformations

---
 gloo-edge/gloo-edge/README.md | 212 ++++++++++++++++++++++++++--------
 1 file changed, 163 insertions(+), 49 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index fa5133e56b..61cfececc7 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1074,67 +1074,181 @@ In this section we will explore how to transform requests using Gloo Edge.
 
 ### Response Transformation
 
+Before, it was mentioned that httpbin is a good tool to debug and test things out. In this section, you will use that application to easily spot results.
+
 The following example demonstrates how to modify a response using Gloo Edge. We are going to return a basic html page when the response code is 429 (rate limited).  
 
 ```bash
 kubectl apply -f - <<EOF
 apiVersion: gateway.solo.io/v1
-kind: VirtualService
+kind: RouteTable
 metadata:
-  name: demo
-  namespace: gloo-system
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
 spec:
-  sslConfig:
-    secretRef:
-      name: upstream-tls
-      namespace: gloo-system  
-  virtualHost:
-    options:
-      extauth:
-        configRef:
-          name: keycloak-oauth
-          namespace: gloo-system
-      rateLimitConfigs:
-        refs:
-        - name: global-limit
-          namespace: gloo-system
-      waf:
-        customInterventionMessage: 'Username should only contain letters'
-        ruleSets:
-        - ruleStr: |
-            # Turn rule engine on
-            SecRuleEngine On
-            SecRule ARGS:/username/ "[^a-zA-Z]" "t:none,phase:2,deny,id:6,log,msg:'allow only letters in username'"
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
 # ---------------- Transformation ------------------          
-      transformations:
-        responseTransformation:
-          transformationTemplate:
-            parseBodyBehavior: DontParse
-            body: 
-              text: '{% if header(":status") == "429" %}<html><body style="background-color:powderblue;"><h1>Too many Requests!</h1><p>Try again after 10 seconds</p></body></html>{% else %}{{ body() }}{% endif %}'    
+        transformations:
+          responseTransformation:
+            transformationTemplate:
+              parseBodyBehavior: DontParse
+              body: 
+                text: '{% if header(":status") == "429" %}<html><body style="background-color:powderblue;"><h1>Too many Requests!</h1><p>Try again after 1 minute</p></body></html>{% else %}{{ body() }}{% endif %}'
 #---------------------------------------------------
-    domains:
-      - '*'
-    routes:
-      - matchers:
-          - prefix: /
-        routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
 EOF
 ```
 
-Refreshing your browser a couple times, you should be able to see a styled HTML page indicating that you reached the limit. 
+Refreshing your browser more than 5 times, you should be able to see a styled HTML page indicating that you reached the limit you have configured before. 
+
+```
+/opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/get
+```
+
+### Manipulate the response when a 401 Not Authorized is returned
+
+The following example shows how to create a transformation taking a value from the header and adding it to a response body:
+
+
+```bash
+kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+# ---------------- Transformation ------------------          
+        stagedTransformations:
+          early:
+            responseTransforms:
+            - responseTransformation:
+                transformationTemplate:
+                  parseBodyBehavior: DontParse
+                  headers:
+                    Content-type: 
+                      text: "application/json"
+                  body:
+                      text: |
+                            {% if header(":status") == "401" %} 
+                            Hold the horses! You are not authenticated
+                            {% else %}{{ body() }}{% endif %}
+#---------------------------------------------------
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+EOF
+```
+
+With httbin application, you can simulate that the server returns a 401 status code. Let's run it and see that calling `/status/401`, the returned body is what we expected
+
+```
+curl -v -k $(glooctl proxy url --port https)/not-secured/status/401
+```
+
+And any other status code, returns the expected body:
+
+```
+curl -v -k $(glooctl proxy url --port https)/not-secured/status/get
+```
+
+### Manipulate the response when a 401 Not Authorized is returned
+
+You can also extract information from one header with regular expressions and inject them into another header:
+
+```bash
+kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+        stagedTransformations:
+          early:
+            responseTransforms:
+            - responseTransformation:
+                transformationTemplate:
+                  parseBodyBehavior: DontParse
+                  headers:
+                    Content-type: 
+                      text: "application/json"
+                  body:
+                      text: |
+                            {% if header(":status") == "401" %} 
+                            Hold the horses! You are not authenticated
+                            {% else %}{{ body() }}{% endif %}
+# ---------------- Transformation with regex ------------------   
+            requestTransforms:       
+            - requestTransformation:
+                transformationTemplate:
+                  extractors:
+                    apiKey:
+                      header: 'x-my-initial-header'
+                      regex: '^Bearer (.*)$'
+                      subgroup: 1
+                  headers:
+                    x-my-final-header:
+                      text: '{{ apiKey }}'
+#--------------------------------------------------------------
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+EOF
+```
+
+With httbin application, calling `/get`, you can debug the request headers. since you are transforming it to add a new header, after running:
+
+```
+curl -k https://34.141.86.2/not-secured/get -H "x-my-initial-header: Bearer this_is_my_token_for_test"
+```
+
+You will see the headers which arrive to the service, including your new transformed one `x-my-final-header` with the specific content after regular expression matching.
+
+```
+{
+  "args": {}, 
+  "headers": {
+    "Accept": "*/*", 
+    "Host": "x.x.x.x", 
+    "User-Agent": "curl/7.64.1", 
+    "X-Envoy-Expected-Rq-Timeout-Ms": "15000", 
+    "X-Envoy-Original-Path": "/not-secured/get", 
+    "X-My-Final-Header": "this_is_my_token_for_test", 
+    "X-My-Initial-Header": "Bearer this_is_my_token_for_test"
+  }, 
+  "origin": "x.x.x.x", 
+  "url": "xxxxxxxxx"
+}
+```
 
 ## Lab 4: Delegation
 

From d9ca50e79eff60887609565f0716f9a7e9f77ff7 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Wed, 21 Jul 2021 18:38:04 +0200
Subject: [PATCH 06/28] reorder labs

---
 gloo-edge/gloo-edge/README.md | 525 +++++++++++-----------------------
 1 file changed, 170 insertions(+), 355 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 61cfececc7..a80d1531b2 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -587,7 +587,14 @@ The browser will warn you that your connection is not private due to the self-si
 
 ### OIDC Support
 
-In many use cases, we need to restrict the access to our applications to authenticated users. In this step, we will secure our application using an OIDC Identity Provider.
+In many use cases, we need to restrict the access to our applications to authenticated users. 
+
+OIDC (OpenID Connect) is an identity layer on top of the OAuth 2.0 protocol. In OAuth 2.0 flows, authentication is performed by an external Identity Provider (IdP) which, in case of success, returns an Access Token representing the user identity. The protocol does not define the contents and structure of the Access Token, which greatly reduces the portability of OAuth 2.0 implementations.
+
+The goal of OIDC is to address this ambiguity by additionally requiring Identity Providers to return a well-defined ID Token. OIDC ID tokens follow the JSON Web Token standard and contain specific fields that your applications can expect and handle. This standardization allows you to switch between Identity Providers – or support multiple ones at the same time – with minimal, if any, changes to your downstream services; it also allows you to consistently apply additional security measures like Role-based Access Control (RBAC) based on the identity of your users, i.e. the contents of their ID token.
+
+
+In this step, we will secure our application using an OIDC Identity Provider.
 
 Let's start by installing Keycloak:
 
@@ -1250,361 +1257,8 @@ You will see the headers which arrive to the service, including your new transfo
 }
 ```
 
-## Lab 4: Delegation
-
-Gloo Edge provides a feature referred to as delegation. Delegation allows a complete routing configuration to be assembled from separate config objects. The root config object delegates responsibility to other objects, forming a tree of config objects. The tree always has a Virtual Service as its root, which delegates to any number of Route Tables. Route Tables can further delegate to other Route Tables.
-
-Use cases for delegation include:
-
-- Allowing multiple tenants to own add, remove, and update routes without requiring shared access to the root-level Virtual Service
-- Sharing route configuration between Virtual Services
-- Simplifying blue-green routing configurations by swapping the target Route Table for a delegated route.
-- Simplifying very large routing configurations for a single Virtual Service
-- Restricting ownership of routing configuration for a tenant to a subset of the whole Virtual Service.
 
-Let's rewrite our Virtual Service to delegate the routing to a Route Table:
-
-```bash
-kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: demo
-  namespace: gloo-system
-spec:
-  routes:
-    - matchers:
-        - prefix: /
-      routeAction:
-          multi:
-              destinations:
-              - weight: 5
-                destination:
-                    upstream:
-                        name: bookinfo-productpage-9080
-                        namespace: gloo-system
-              - weight: 5
-                destination:
-                    upstream:
-                        name: bookinfo-beta-productpage-9080
-                        namespace: gloo-system
----
-apiVersion: gateway.solo.io/v1
-kind: VirtualService
-metadata:
-  name: demo
-  namespace: gloo-system
-spec:
-  sslConfig:
-    secretRef:
-      name: upstream-tls
-      namespace: gloo-system  
-  virtualHost:
-    options:
-      extauth:
-        configRef:
-          name: keycloak-oauth
-          namespace: gloo-system
-      rateLimitConfigs:
-        refs:
-        - name: global-limit
-          namespace: gloo-system
-      waf:
-        customInterventionMessage: 'Username should only contain letters'
-        ruleSets:
-        - ruleStr: |
-            # Turn rule engine on
-            SecRuleEngine On
-            SecRule ARGS:/username/ "[^a-zA-Z]" "t:none,phase:2,deny,id:6,log,msg:'allow only letters in username'"
-      transformations:
-        responseTransformation:
-          transformationTemplate:
-            parseBodyBehavior: DontParse
-            body: 
-              text: '{% if header(":status") == "429" %}<html><body style="background-color:powderblue;"><h1>Too many Requests!</h1><p>Try again after 10 seconds</p></body></html>{% else %}{{ body() }}{% endif %}'
-    domains:
-      - '*'
-    routes:
-      - matchers:
-          - prefix: /
-        delegateAction:
-          ref:
-            name: 'demo'
-            namespace: 'gloo-system'
-EOF
-```
-
-As you can see, in this case the security options remains in the `VirtualService` (and can be managed by the infrastructure team) while the routing options are now in the `RouteTable` (and can be managed by the application team).
-
-## Lab 5: Observability
-
-### Metrics
-
-Gloo Edge automatically generates a Grafana dashboard for whole-cluster stats (overall request timing, aggregated response codes, etc.), and dynamically generates a more-specific dashboard for each upstream that is tracked.
-
-Let's run the following command to allow access to the Grafana UI:
-
-```
-kubectl port-forward -n gloo-system svc/glooe-grafana 8001:80
-```
-
-You can now access the Grafana UI at http://localhost:8001 and login with `admin/admin`.
-
-You can take a look at the `Gloo -> Envoy Statistics` Dashboard that provides global statistics:
-
-![Grafana Envoy Statistics](images/grafana1.png)
-
-You can also see that Gloo is dynamically generating a Dashboard for each Upstream:
-
-![Grafana Upstream](images/grafana2.png)
-
-You can run the following command to see the default template used to generate these templates:
-
-```
-kubectl -n gloo-system get cm gloo-observability-config -o yaml
-```
-
-If you want to customize how these per-upstream dashboards look, you can provide your own template to use by writing a Grafana dashboard JSON representation to that config map key. 
-
-### Access Logging
-
-Access logs are important to check if a system is behaving correctly and for debugging purposes. Log aggregators like Datadog and Splunk use agents deployed on the Kubernetes clusters to collect logs.  
-
-Lets first enable access logging on the gateway: 
-
-```bash
-kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: Gateway
-metadata:
-  labels:
-    app: gloo
-  name: gateway-proxy-ssl
-  namespace: gloo-system
-spec:
-  bindAddress: '::'
-  bindPort: 8443
-  httpGateway: {}
-  proxyNames:
-  - gateway-proxy
-  ssl: true
-  useProxyProto: false
-  options:
-    accessLoggingService:
-      accessLog:
-      - fileSink:
-          jsonFormat:
-            # HTTP method name
-            httpMethod: '%REQ(:METHOD)%'
-            # Protocol. Currently either HTTP/1.1 or HTTP/2.
-            protocol: '%PROTOCOL%'
-            # HTTP response code. Note that a response code of ‘0’ means that the server never sent the
-            # beginning of a response. This generally means that the (downstream) client disconnected.
-            responseCode: '%RESPONSE_CODE%'
-            # Total duration in milliseconds of the request from the start time to the last byte out
-            clientDuration: '%DURATION%'
-            # Total duration in milliseconds of the request from the start time to the first byte read from the upstream host
-            targetDuration: '%RESPONSE_DURATION%'
-            # Value of the "x-envoy-original-path" header (falls back to "path" header if not present)
-            path: '%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%'
-            # Upstream cluster to which the upstream host belongs to
-            upstreamName: '%UPSTREAM_CLUSTER%'
-            # Request start time including milliseconds.
-            systemTime: '%START_TIME%'
-            # Unique tracking ID
-            requestId: '%REQ(X-REQUEST-ID)%'
-            # Response flags; will contain RL if the request was rate-limited
-            responseFlags: '%RESPONSE_FLAGS%'
-            # We rate-limit on the x-type header
-            messageType: '%REQ(x-type)%'
-            # We rate-limit on the x-number header
-            number: '%REQ(x-number)%'
-          path: /dev/stdout
-EOF
-```
-
-NOTE:  You can safely ignore the following warning when you run the above command:
-
-```
-Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
-```
-
-Refresh your browser a couple times to generate some traffic.
-
-Check the access logs running the following command:
-
-```bash
-kubectl logs -n gloo-system deployment/gateway-proxy | grep '^{' | jq
-```
-
-If you refresh the browser to send additional requests until the rate limiting threshold is exceeded, then you will see both `200 OK` and `429 Too Many Requests` responses in the access logs, as in the example below.
-
-```
-{
-  "messageType": null,
-  "requestId": "06c54299-de6b-463e-8035-aebd3e530cb5",
-  "httpMethod": "GET",
-  "systemTime": "2020-10-22T21:38:18.316Z",
-  "path": "/productpage",
-  "targetDuration": 31,
-  "protocol": "HTTP/2",
-  "responseFlags": "-",
-  "number": null,
-  "clientDuration": 31,
-  "upstreamName": "bookinfo-beta-productpage-9080_gloo-system",
-  "responseCode": 200
-}
-{
-  "httpMethod": "GET",
-  "systemTime": "2020-10-22T21:38:19.168Z",
-  "targetDuration": null,
-  "path": "/productpage",
-  "protocol": "HTTP/2",
-  "responseFlags": "-",
-  "clientDuration": 3,
-  "number": null,
-  "responseCode": 429,
-  "upstreamName": null,
-  "messageType": null,
-  "requestId": "494c3cc7-e476-4414-8c50-499f3619f84c"
-}
-```
-
-These logs can now be collected by the Log aggregator agents and potentially forwarded to your favorite enterprise logging service. 
-
-The following labs are optional. The instructor will go through them.
-
-## Lab 6: Advanced Authentication Workflows
-
-As you've seen in the previous lab, Gloo Edge supports authentication via OpenID Connect (OIDC). OIDC is an identity layer on top of the OAuth 2.0 protocol. In OAuth 2.0 flows, authentication is performed by an external Identity Provider (IdP) which, in case of success, returns an Access Token representing the user identity. The protocol does not define the contents and structure of the Access Token, which greatly reduces the portability of OAuth 2.0 implementations.
-
-The goal of OIDC is to address this ambiguity by additionally requiring Identity Providers to return a well-defined ID Token. OIDC ID tokens follow the JSON Web Token standard and contain specific fields that your applications can expect and handle. This standardization allows you to switch between Identity Providers – or support multiple ones at the same time – with minimal, if any, changes to your downstream services; it also allows you to consistently apply additional security measures like Role-based Access Control (RBAC) based on the identity of your users, i.e. the contents of their ID token.
-
-As explained above, Keycloak will return a JWT token, so we’ll use Gloo to extract some claims from this token and to create new headers corresponding to these claims.
-
-Finally, we’ll see how Gloo Edge RBAC rules can be created to leverage the claims contained in the JWT token.
-
-First of all, let's deploy a new application that returns information about the requests it receives:
-
-```bash
-kubectl apply -f - <<EOF
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: httpbin
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: httpbin
-  labels:
-    app: httpbin
-spec:
-  ports:
-  - name: http
-    port: 8000
-    targetPort: 80
-  selector:
-    app: httpbin
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: httpbin
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: httpbin
-      version: v1
-  template:
-    metadata:
-      labels:
-        app: httpbin
-        version: v1
-    spec:
-      serviceAccountName: httpbin
-      containers:
-      - image: docker.io/kennethreitz/httpbin
-        imagePullPolicy: IfNotPresent
-        name: httpbin
-        ports:
-        - containerPort: 80
-EOF
-```
-
-Let’s modify the Virtual Service using the yaml below:
-
-```bash
-kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: VirtualService
-metadata:
-  name: demo
-  namespace: gloo-system
-spec:
-  sslConfig:
-    secretRef:
-      name: upstream-tls
-      namespace: gloo-system  
-  virtualHost:
-    options:
-      extauth:
-        configRef:
-          name: keycloak-oauth
-          namespace: gloo-system
-    domains:
-      - '*'
-    routes:
-      - matchers:
-          - prefix: /
-        routeAction:
-            single:
-              upstream:
-                name: default-httpbin-8000
-                namespace: gloo-system
-EOF
-```
-
-Let's take a look at what the application returns:
-
-```
-/opt/google/chrome/chrome $(glooctl proxy url --port https)/get 
-```
-
-You should get the following output:
-
-```
-{
-  "args": {}, 
-  "headers": {
-    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", 
-    "Accept-Encoding": "gzip, deflate, br", 
-    "Accept-Language": "en-US,en;q=0.9", 
-    "Content-Length": "0", 
-    "Cookie": "id_token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJZd18zVTBoOFFkbGpsODBiSkQxUDhzbUtud0ZYYkVJZE0xZjlMU3R1N2E0In0.eyJleHAiOjE2MDc0MTkxNjksImlhdCI6MTYwNzQxOTEwOSwiYXV0aF90aW1lIjoxNjA3NDE4NzQ5LCJqdGkiOiI0NzMyNjU5Mi0xY2Q0LTQzNjItODA5ZS01NzA2YzU5MTU2MzYiLCJpc3MiOiJodHRwOi8vMTcyLjE4LjAuMjExOjgwODAvYXV0aC9yZWFsbXMvbWFzdGVyIiwiYXVkIjoiZjg3YzAzOWQtNTdiZi00NTQzLWExZjAtOGIyMmZjNmY5ZTYwIiwic3ViIjoiN2Q0N2I2YmYtOTcyYi00OGRjLWI3YjctM2U5N2NlZGM4NjM1IiwidHlwIjoiSUQiLCJhenAiOiJmODdjMDM5ZC01N2JmLTQ1NDMtYTFmMC04YjIyZmM2ZjllNjAiLCJzZXNzaW9uX3N0YXRlIjoiOGJmNjAzMTYtY2NmYi00ZWZkLWFiNDgtOTc5MmQzNTkzNzBhIiwiYXRfaGFzaCI6InJxZHVfVEVucHZaUElDSm1SblMwM0EiLCJhY3IiOiIwIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ1c2VyMSIsImVtYWlsIjoidXNlcjFAc29sby5pbyIsImdyb3VwIjoidXNlcnMifQ.FnuiURxT6Y8NZGKcFxlud0jgz9QieZiYx5zB0VXeIMeTrKvcmWxkFEViIF22MvaGh2jYRSoSCCqiR3JwMgmMTtDU2NPuAL6FyLbeeOOxOw6h7zc4XRKHzzwPH4p8l6Np4GLgHEPzlP_ZGochgieeYGA5kKzV2r6BrFFoKAbHTio5waJlnyDQQ6_EbBfHngrgiW8ngrMD5RiryhJ-idaNae_bM0KrXTow0xVFpOlo59E03N_QamJeegAPZnwpm5meEMN1w8uHm2WRe3NtUxb2sLBoQoJIKZj-7AsRNPzfJ5kbUQ250Sdbeeo4t6mmO5Vf472DkxzyPho3gf-avLINLg; access_token=eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJZd18zVTBoOFFkbGpsODBiSkQxUDhzbUtud0ZYYkVJZE0xZjlMU3R1N2E0In0.eyJleHAiOjE2MDc0MTkxNjksImlhdCI6MTYwNzQxOTEwOSwiYXV0aF90aW1lIjoxNjA3NDE4NzQ5LCJqdGkiOiJhNmI5MDk5MC0zYjBhLTQwZjItYmI0Yy0yMTc0NTlmZjUyMjQiLCJpc3MiOiJodHRwOi8vMTcyLjE4LjAuMjExOjgwODAvYXV0aC9yZWFsbXMvbWFzdGVyIiwiYXVkIjoiYWNjb3VudCIsInN1YiI6IjdkNDdiNmJmLTk3MmItNDhkYy1iN2I3LTNlOTdjZWRjODYzNSIsInR5cCI6IkJlYXJlciIsImF6cCI6ImY4N2MwMzlkLTU3YmYtNDU0My1hMWYwLThiMjJmYzZmOWU2MCIsInNlc3Npb25fc3RhdGUiOiI4YmY2MDMxNi1jY2ZiLTRlZmQtYWI0OC05NzkyZDM1OTM3MGEiLCJhY3IiOiIwIiwicmVhbG1fYWNjZXNzIjp7InJvbGVzIjpbIm9mZmxpbmVfYWNjZXNzIiwidW1hX2F1dGhvcml6YXRpb24iXX0sInJlc291cmNlX2FjY2VzcyI6eyJhY2NvdW50Ijp7InJvbGVzIjpbIm1hbmFnZS1hY2NvdW50IiwibWFuYWdlLWFjY291bnQtbGlua3MiLCJ2aWV3LXByb2ZpbGUiXX19LCJzY29wZSI6Im9wZW5pZCBlbWFpbCBwcm9maWxlIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ1c2VyMSIsImVtYWlsIjoidXNlcjFAc29sby5pbyIsImdyb3VwIjoidXNlcnMifQ.NT4_BFfaDvngCKkg2X1_8eIiyA76sCwIbNo0nFdnelg9wr1PBCW1mFLh8PvD4NQjy26KuYZswMoGtwP5y-6PAuHzoH9Pxe2peeLEGuWhhDfhjE9RknG9qFxVS1jV3-i3rTewoPMJKHFP29Ocmkl9CB31zShOyhsj19YTYWy7wB9Da_GMH7kRjmvYaiZOsNdZ8LVNBeFTp0QYz1xTss-KABBXJNbC164aokWGDwe2wDPyNPf9ZYoEQ4zwjX4Qt5-hBaBnMIH6Je4hei05pjZikiuDcW4KvGOEAfFR6xPWLW0pfxfmuKghAigYhpq5BmLIisgByN0jsfVGRcKkD1_gXQ", 
-    "Host": "172.18.1.1", 
-    "Sec-Fetch-Dest": "document", 
-    "Sec-Fetch-Mode": "navigate", 
-    "Sec-Fetch-Site": "none", 
-    "Sec-Fetch-User": "?1", 
-    "Upgrade-Insecure-Requests": "1", 
-    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36", 
-    "X-Envoy-Expected-Rq-Timeout-Ms": "15000", 
-    "X-User-Id": "http://172.18.1.2:8080/auth/realms/master;7d47b6bf-972b-48dc-b7b7-3e97cedc8635"
-  }, 
-  "origin": "192.168.149.15", 
-  "url": "https://172.18.1.1/get"
-}
-```
-
-As you can see, the browser has sent the cookie as a header in the HTTP request.
-
-### Request transformation
-
-Gloo is able to perform advanced transformations of the request and response.
-
-Let’s modify the Virtual Service using the yaml below:
+### Obtain a value from the token
 
 ```bash
 kubectl apply -f - <<EOF
@@ -1659,6 +1313,25 @@ EOF
 
 This transformation is using a regular expression to extract the JWT token from the `cookie` header, creates a new `jwt` header that contains the token and removes the `cookie` header.
 
+As explained in previous Labs, Keycloak will return a JWT token, so we’ll use Gloo to extract some claims from this token and to create new headers corresponding to these claims.
+
+Finally, we’ll see how Gloo Edge RBAC rules can be created to leverage the claims contained in the JWT token.
+
+
+As you can see, the browser has sent the cookie as a header in the HTTP request.
+
+
+### Getting more details from token
+
+
+
+
+Gloo is able to perform advanced transformations of the request and response.
+
+Let’s modify the Virtual Service using the yaml below:
+
+
+
 Here is the output you should get if you refresh the web page:
 
 ```
@@ -2014,5 +1687,147 @@ Let's try again in incognito window using the second user's credentials:
 If you open the browser in incognito and login using `user2/password` credentials, you will not be able to access since the user's email ends with `@example.com`:
 
 
+## Lab 5: Observability
+
+### Metrics
+
+Gloo Edge automatically generates a Grafana dashboard for whole-cluster stats (overall request timing, aggregated response codes, etc.), and dynamically generates a more-specific dashboard for each upstream that is tracked.
+
+Let's run the following command to allow access to the Grafana UI:
+
+```
+kubectl port-forward -n gloo-system svc/glooe-grafana 8001:80
+```
+
+You can now access the Grafana UI at http://localhost:8001 and login with `admin/admin`.
+
+You can take a look at the `Gloo -> Envoy Statistics` Dashboard that provides global statistics:
+
+![Grafana Envoy Statistics](images/grafana1.png)
+
+You can also see that Gloo is dynamically generating a Dashboard for each Upstream:
+
+![Grafana Upstream](images/grafana2.png)
+
+You can run the following command to see the default template used to generate these templates:
+
+```
+kubectl -n gloo-system get cm gloo-observability-config -o yaml
+```
+
+If you want to customize how these per-upstream dashboards look, you can provide your own template to use by writing a Grafana dashboard JSON representation to that config map key. 
+
+### Access Logging
+
+Access logs are important to check if a system is behaving correctly and for debugging purposes. Log aggregators like Datadog and Splunk use agents deployed on the Kubernetes clusters to collect logs.  
+
+Lets first enable access logging on the gateway: 
+
+```bash
+kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: Gateway
+metadata:
+  labels:
+    app: gloo
+  name: gateway-proxy-ssl
+  namespace: gloo-system
+spec:
+  bindAddress: '::'
+  bindPort: 8443
+  httpGateway: {}
+  proxyNames:
+  - gateway-proxy
+  ssl: true
+  useProxyProto: false
+  options:
+    accessLoggingService:
+      accessLog:
+      - fileSink:
+          jsonFormat:
+            # HTTP method name
+            httpMethod: '%REQ(:METHOD)%'
+            # Protocol. Currently either HTTP/1.1 or HTTP/2.
+            protocol: '%PROTOCOL%'
+            # HTTP response code. Note that a response code of ‘0’ means that the server never sent the
+            # beginning of a response. This generally means that the (downstream) client disconnected.
+            responseCode: '%RESPONSE_CODE%'
+            # Total duration in milliseconds of the request from the start time to the last byte out
+            clientDuration: '%DURATION%'
+            # Total duration in milliseconds of the request from the start time to the first byte read from the upstream host
+            targetDuration: '%RESPONSE_DURATION%'
+            # Value of the "x-envoy-original-path" header (falls back to "path" header if not present)
+            path: '%REQ(X-ENVOY-ORIGINAL-PATH?:PATH)%'
+            # Upstream cluster to which the upstream host belongs to
+            upstreamName: '%UPSTREAM_CLUSTER%'
+            # Request start time including milliseconds.
+            systemTime: '%START_TIME%'
+            # Unique tracking ID
+            requestId: '%REQ(X-REQUEST-ID)%'
+            # Response flags; will contain RL if the request was rate-limited
+            responseFlags: '%RESPONSE_FLAGS%'
+            # We rate-limit on the x-type header
+            messageType: '%REQ(x-type)%'
+            # We rate-limit on the x-number header
+            number: '%REQ(x-number)%'
+          path: /dev/stdout
+EOF
+```
+
+NOTE:  You can safely ignore the following warning when you run the above command:
+
+```
+Warning: kubectl apply should be used on resource created by either kubectl create --save-config or kubectl apply
+```
+
+Refresh your browser a couple times to generate some traffic.
+
+Check the access logs running the following command:
+
+```bash
+kubectl logs -n gloo-system deployment/gateway-proxy | grep '^{' | jq
+```
+
+If you refresh the browser to send additional requests until the rate limiting threshold is exceeded, then you will see both `200 OK` and `429 Too Many Requests` responses in the access logs, as in the example below.
+
+```
+{
+  "messageType": null,
+  "requestId": "06c54299-de6b-463e-8035-aebd3e530cb5",
+  "httpMethod": "GET",
+  "systemTime": "2020-10-22T21:38:18.316Z",
+  "path": "/productpage",
+  "targetDuration": 31,
+  "protocol": "HTTP/2",
+  "responseFlags": "-",
+  "number": null,
+  "clientDuration": 31,
+  "upstreamName": "bookinfo-beta-productpage-9080_gloo-system",
+  "responseCode": 200
+}
+{
+  "httpMethod": "GET",
+  "systemTime": "2020-10-22T21:38:19.168Z",
+  "targetDuration": null,
+  "path": "/productpage",
+  "protocol": "HTTP/2",
+  "responseFlags": "-",
+  "clientDuration": 3,
+  "number": null,
+  "responseCode": 429,
+  "upstreamName": null,
+  "messageType": null,
+  "requestId": "494c3cc7-e476-4414-8c50-499f3619f84c"
+}
+```
+
+These logs can now be collected by the Log aggregator agents and potentially forwarded to your favorite enterprise logging service. 
+
+The following labs are optional. The instructor will go through them.
+
+
+
+
+
 
 This is the end of the workshop. We hope you enjoyed it !
\ No newline at end of file

From 1cd05c24bb5f5950a258e9d674abba9c61271513 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Wed, 21 Jul 2021 20:04:16 +0200
Subject: [PATCH 07/28] Review NOT FINISHED

---
 gloo-edge/gloo-edge/README.md | 478 +++++++++++++++++++++++++++++-----
 1 file changed, 410 insertions(+), 68 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index a80d1531b2..5c21ae41f3 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -9,6 +9,7 @@ The goal of this workshop is to expose some key features of Gloo API Gateway, li
 The lab environment consists of a Kubernetes environment deployed locally using kind.
 
 In this workshop we will:
+TODO: Redo summary
 * Deploy a demo application (Istio's [bookinfo](https://istio.io/latest/docs/examples/bookinfo/) demo app) on a k8s cluster and expose it through Gloo Edge
 * Deploy a second version of the demo app and route traffic to both versions
 * Secure the demo app using TLS
@@ -73,7 +74,7 @@ done
 
 In this step we will expose two demo services to the outside world using Gloo Edge.
 
-First let's deploy a demo application called bookinfo in `bookinfo` namespace:
+First let's deploy a demo application called **bookinfo** in `bookinfo` namespace:
 
 ```bash
 kubectl create ns bookinfo 
@@ -113,7 +114,9 @@ It should return the discovered upstream with an `Accepted` status:
 +---------------------------+------------+----------+----------------------------+
 ```
 
-Now, let's deploy the second application, called httpbin in `team1` namespace:
+Now, let's deploy the second application, called **httpbin** in the namespace `team1`.
+
+This application is very useful when you have to debug routing, headers in requests, responses, status codes, etc. The public online version of it can be found [here](http://httpbin.org/).
 
 ```bash
 kubectl create ns team1
@@ -168,8 +171,6 @@ spec:
 EOF
 ```
 
-The httpbin application is very useful to debug requests and responses. The online version of it can be found [here](http://httpbin.org/).
-
 ![Gloo Edge with Httpbin](images/httpbin.png)
 
 To verify that the Upstream was created properly, run the following command: 
@@ -314,10 +315,12 @@ Use cases for delegation include:
 
 Let's rewrite our Virtual Service to delegate the routing to a Route Table.
 
-First, the Route Table:
+First resource is the delegated Route Table. Second resource is a Virtual Service. Notice that there is a new `delegateAction` referencing the just created Route Table.
+
 
 ```bash
 kubectl apply -f - <<EOF
+# ------------- Delegation resource ------------------
 apiVersion: gateway.solo.io/v1
 kind: RouteTable
 metadata:
@@ -334,14 +337,10 @@ spec:
             upstream:
               name: team1-httpbin-8000
               namespace: gloo-system
-EOF
-```
-
-And now, the Virtual Service. Notice that there is a new `delegateAction` pointing to the just created Route Table.
+# ------------------------------------------------------
 
+---
 
-```bash
-kubectl apply -f - <<EOF
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -354,12 +353,12 @@ spec:
     routes:
       - matchers:
           - prefix: /not-secured
-# -------------Delegation by reference------------------
+# ------------- Delegation action by reference ------------------
         delegateAction:
           ref:
             name: 'httpbin-routetable'
             namespace: 'team1'
-# ------------------------------------------------------
+# ---------------------------------------------------------------
       - matchers:
           - prefix: /
         routeAction:
@@ -370,9 +369,9 @@ spec:
 EOF
 ```
 
-### Delegation With Label
+### Delegation By Label Selector
 
-Another way to delegate is to use labels. This approach frees the direct dependency with strict name references. Let's update our Route Table to add a label which, then, it will be configured by the Virtual Service.
+Another way to delegate is to use labels. This approach helps you to create dynamic references. Let's update your Route Table to add a label. Then, the label will be used in the Virtual Service resource.
 
 Let's make both changes:
 
@@ -383,10 +382,10 @@ kind: RouteTable
 metadata:
   name: httpbin-routetable
   namespace: team1
-# -------------Delegation by reference------------------
+# ------------- Label to use as dynamic reference ------------------
   labels:
     application-owner: team1
-# ------------------------------------------------------
+# ------------------------------------------------------------------
 spec:
   routes:
     - matchers:
@@ -413,14 +412,14 @@ spec:
     routes:
       - matchers:
           - prefix: /not-secured
-# -------------Delegation by label selector ------------
+# ------------- Delegation by label selector ------------
         delegateAction:
           selector:
             namespaces:
               - team1
             labels:
               application-owner: team1
-# ------------------------------------------------------
+# -------------------------------------------------------
       - matchers:
           - prefix: /
         routeAction:
@@ -457,10 +456,31 @@ do
 done
 ```
 
-Now we can route to multiple Upstreams by updating the Virtual Service as follow: 
+Now you can route to multiple Upstreams by updating the Virtual Service as follow: 
 
 ```bash
 kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -503,45 +523,65 @@ We should see either the **black** star reviews (v2) or the new **red** star rev
 
 ![Bookinfo Web Interface](images/2.png)
 
-## Lab 2: Security
+## Lab 2: Security And Authentication
 
-In this lab, we will explore some Gloo Edge features related to security. 
+In this lab, you will explore some Gloo Edge features related to security and Authentication. 
 
 ### Network Encryption - Server TLS
 
-In this step we are going to secure our demo application using TLS.
+In this step you are going to secure you demo application using TLS.
 
-Let's first create a private key and a self-signed certificate to use in our demo Virtual Service:
+Let's first create a private key and a self-signed certificate to use in your demo Virtual Service:
 
 ```bash
 openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
    -keyout tls.key -out tls.crt -subj "/CN=*"
 ```
 
-Then we have store them in a Kubernetes secret running the following command:
+Then, you have to store them in a Kubernetes secret running the following command:
 
 ```bash
 kubectl create secret tls upstream-tls --key tls.key \
    --cert tls.crt --namespace gloo-system
 ```
 
-To setup TLS we have to add the SSL config to the Virtual Service:
+To setup TLS you have to add the SSL config to the Virtual Service:
 
 ```bash
 kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
   name: demo
   namespace: gloo-system
 spec:
-  # The SSL config below activate TLS on the Virtual Service
-  # ------------
+# ---------------- SSL config ---------------------------
   sslConfig:
     secretRef:
       name: upstream-tls
       namespace: gloo-system
-  # ------------    
+# -------------------------------------------------------    
   virtualHost:
     domains:
       - '*'
@@ -575,8 +615,11 @@ EOF
 Now the application is securely exposed through TLS. To test the TLS configuration, run the following command to open the browser (note that now the traffic is served using https): 
 
 ```bash
-APP_URL=$(glooctl proxy url --port https | cut -d: -f1-2)
+export APP_URL=$(glooctl proxy url --port https | cut -d: -f1-2)
 ```
+
+Let's check **bookinfo**:
+
 ```
 /opt/google/chrome/chrome $APP_URL/productpage 
 ```
@@ -585,16 +628,24 @@ The browser will warn you that your connection is not private due to the self-si
 
 ![Self-Signed Certificate Warning](images/self-signed-cert-error.png)
 
-### OIDC Support
 
-In many use cases, we need to restrict the access to our applications to authenticated users. 
+And **httpbin**:
+
+> Since you are using self-signed certificates, you need to allow insecure sever connection when using SSL with *-k*
+
+```
+curl -k $APP_URL/not-secured/get
+```
+### Authentication with OIDC (OpenID Connect)
+
+In many use cases, you need to restrict the access to your applications to authenticated users. 
 
 OIDC (OpenID Connect) is an identity layer on top of the OAuth 2.0 protocol. In OAuth 2.0 flows, authentication is performed by an external Identity Provider (IdP) which, in case of success, returns an Access Token representing the user identity. The protocol does not define the contents and structure of the Access Token, which greatly reduces the portability of OAuth 2.0 implementations.
 
 The goal of OIDC is to address this ambiguity by additionally requiring Identity Providers to return a well-defined ID Token. OIDC ID tokens follow the JSON Web Token standard and contain specific fields that your applications can expect and handle. This standardization allows you to switch between Identity Providers – or support multiple ones at the same time – with minimal, if any, changes to your downstream services; it also allows you to consistently apply additional security measures like Role-based Access Control (RBAC) based on the identity of your users, i.e. the contents of their ID token.
 
 
-In this step, we will secure our application using an OIDC Identity Provider.
+In this step, you will secure **bookinfo** application using an OIDC Identity Provider.
 
 Let's start by installing Keycloak:
 
@@ -615,7 +666,13 @@ Then, we need to configure it and create two users:
 - User2 credentials: `user2/password`
   Email: user2@example.com
 
-> **Note:** One of the following commands retrieves a token which expires quite soon. If you get a *Not Authorized* error, please, re-run the second command to retrieve another token (the one starting with `KEYCLOAK_TOKEN=`)
+> **Note:** One of the following commands retrieves a token which expires quite soon. If you get a *Not Authorized* error, please, re-run this command:
+
+```
+KEYCLOAK_TOKEN=$(curl -d "client_id=admin-cli" -d "username=admin" -d "password=admin" -d "grant_type=password" "$KEYCLOAK_URL/realms/master/protocol/openid-connect/token" | jq -r .access_token)
+```
+
+Let's create the users:
 
 ```bash
 # Get Keycloak URL and token
@@ -651,7 +708,7 @@ The next step is to configure the authentication in the Virtual Service. For thi
 glooctl create secret oauth --namespace gloo-system --name keycloak-oauth --client-secret ${secret}
 ```
 
-Then we will create an AuthConfig, which is a Gloo Edge CRD that contains authentication information: 
+Then you will create an AuthConfig, which is a Gloo Edge CRD that contains authentication information: 
 
 ```bash
 kubectl apply -f - <<EOF
@@ -676,10 +733,33 @@ spec:
 EOF
 ```
 
-Finally we activate the authentication on the Route Table by referencing the AuthConfig:
+Finally you activate the authentication on the Virtual Service by referencing the AuthConfig:
+
+> Notice that this only applies to a specif route, because it is configured within a **matcher**
 
 ```bash
 kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -704,13 +784,13 @@ spec:
               application-owner: team1
       - matchers:
           - prefix: /
-# ------------------- OIDC -------------------
+# ------------------- OIDC - Only applied to this matcher -------------------
         options:
           extauth:
             configRef:
               name: keycloak-oauth
               namespace: gloo-system
-# --------------------------------------------
+# ---------------------------------------------------------------------------
         routeAction:
             multi:
                 destinations:
@@ -728,21 +808,28 @@ spec:
 EOF
 ```
 
-To test the authentication, try to access httpbin application. You will see that Authentication is not required.
+To test the Authentication, try first to access **httpbin** application. You will see that Authentication is NOT required.
 
-On the other hand, if you refresh the web browser for the bookinfo application, you will be redirected to the authentication challenge.
+```
+curl -k $APP_URL/not-secured/get
+```
 
-If you login as the `user1` user with the password `password`, Gloo should redirect you to the application.
+On the other hand, if you refresh the web browser for the **bookinfo** application, you will be redirected to the authentication challenge.
 
-![Keycloak Authentication Dialog](images/3.png)
+```
+/opt/google/chrome/chrome $APP_URL/productpage 
+```
 
+If you use username: `user1`; and password: `password`; Gloo should redirect you back to the **bookinfo** application.
+
+![Keycloak Authentication Dialog](images/3.png)
 
 
-### Rate Limiting
+## Lab 3: Rate Limiting
 
-In this step, we are going to use rate limiting to protect our demo application.
+In this lab, you are going to use rate limiting to protect only **bookinfo** applications.
 
-To enable rate limiting on our Virtual Service, we will first create a RateLimitConfig CR:
+To enable rate limiting on your Virtual Service, you will first create a RateLimitConfig resource:
 
 ```bash
 kubectl apply -f - << EOF
@@ -766,10 +853,31 @@ spec:
 EOF
 ```
 
-Now let's update our Virtual Service to use the bookinfo application with the new rate limit enforced: 
+Now let's update your Virtual Service to use the **bookinfo** application with the new rate limit enforced. The changes affect only one **matcher** (the one for **bookinfo**):
 
 ```bash
 kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -825,10 +933,14 @@ To test rate limiting, refresh the browser until you see a 429 message.
 
 ![Browser 429 Too Many Requests Interface](images/4.png)
 
+```
+/opt/google/chrome/chrome $APP_URL/productpage 
+```
+
 
 ### Rate Limiting For Authenticated Users
 
-Now, let's change the Rate Limit to be only applied for Authenticated Users. But this time, you will apply the changes directly in the Virtual Service.
+Now, let's change the Rate Limit to be only applied for Authenticated Users. But this time, you will apply the changes directly in the Virtual Service. This will affect all routes.
 
 First, let's delete the Rate Limit Configuration you have created before:
 
@@ -836,10 +948,31 @@ First, let's delete the Rate Limit Configuration you have created before:
 kubectl delete ratelimitconfig global-limit -n gloo-system
 ```
 
-And now, let's update your Virtual Service to add the Rate Limit Configuration directly in there:
+And now, let's update your Virtual Service to add the Rate Limit Configuration directly in the Virtual Service resource:
 
 ```bash
 kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -895,28 +1028,53 @@ spec:
 EOF
 ```
 
-Refresh the httpbin application and after 5 times, you will retrieve a 429 error. This is because you are an anonymous user.
+Refresh the **httpbin** application and after 5 times, you will retrieve a **429 error**. This is because you are an anonymous user.
 
 ```
 /opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/get
 ```
 
-Try it with the bookinfo application, and the number of requests will be limited to 20 as you are an Authenticated user. Notice that the requests for static content also counts.
+Now, try it with the **bookinfo** application, and the number of requests will be limited to 20 as you are an Authenticated user. 
+
+> Notice that the requests for static content also count since they share the route `/`.
+> `/productpage`
+> `/static/`
 
 ```
 /opt/google/chrome/chrome $(glooctl proxy url --port https)/productpage
 ```
 
-### Web Application Firewall (WAF)
+## Lab 4: Web Application Firewall (WAF)
 
 A web application firewall (WAF) protects web applications by monitoring, filtering and blocking potentially harmful traffic and attacks that can overtake or exploit them.
 
 Gloo Edge Enterprise includes the ability to enable the ModSecurity Web Application Firewall for any incoming and outgoing HTTP connections. 
 
-Let's update the Virtual Service to restrict requests with huge payload to avoid Large Payload Post DDoS Attack. The intention of this DDoS attack is abuse on the amount of memory to decode the payload
+Let's update the Virtual Service to restrict requests with huge payload to avoid *Large Payload Post DDoS Attack*. The intention of this DDoS attack is abuse on the amount of memory used to decode the payload bringing the server down.
 
 ```bash
 kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -979,7 +1137,7 @@ spec:
 EOF
 ```
 
-The rule means that a body's size cannot be greater than 1KB.
+The rule means that the request body's size cannot be greater than 1KB.
 
 Run following command to test it:
 
@@ -994,12 +1152,35 @@ Payload sizes above 1KB not allowed
 ```
 
 
-#### WAF Block well-known User-Agents
+#### WAF Blocks well-known harmful User-Agents
+
+Another kind of attack is done by some recognized User-Agents.
 
-Another kind of attack is done by some recognized User-Agents
+In this step, you will block `scammer`:
 
 ```bash
 kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -1061,12 +1242,12 @@ spec:
 EOF
 ```
 
-The rule means an well known scammer User-Agent will be blocked.
+The rule means a well known `scammer` User-Agent will be blocked.
 
 Run following command to test it:
 
 ```
-curl -k https://34.141.86.2/not-secured/get -H "Content-Type: application/xml" -H 'User-Agent: scammer'
+curl -k $(glooctl proxy url --port https)/not-secured/get -H "Content-Type: application/xml" -H 'User-Agent: scammer'
 ```
 
 You should get the following error message:
@@ -1075,15 +1256,15 @@ You should get the following error message:
 Blocked Scammer
 ```
 
-## Lab 3: Data Transformation
+## Lab 5: Data Transformation
 
-In this section we will explore how to transform requests using Gloo Edge.
+In this section you will explore how to transform requests and responses using Gloo Edge.
 
 ### Response Transformation
 
-Before, it was mentioned that httpbin is a good tool to debug and test things out. In this section, you will use that application to easily spot results.
+Before, it was mentioned that **httpbin** is a good tool to debug and test things out. In this section, you will use that application to easily spot the results.
 
-The following example demonstrates how to modify a response using Gloo Edge. We are going to return a basic html page when the response code is 429 (rate limited).  
+Following example demonstrates how to modify a response using Gloo Edge. We are going to return a basic html page when the response code is 429 (rate limited).  
 
 ```bash
 kubectl apply -f - <<EOF
@@ -1113,10 +1294,69 @@ spec:
             upstream:
               name: team1-httpbin-8000
               namespace: gloo-system
+
+---
+
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: demo
+  namespace: gloo-system
+spec:
+  sslConfig:
+    secretRef:
+      name: upstream-tls
+      namespace: gloo-system  
+  virtualHost:
+    domains:
+      - '*'
+    options:
+      ratelimitBasic:
+        anonymousLimits:
+          requestsPerUnit: 5
+          unit: MINUTE
+        authorizedLimits:
+          requestsPerUnit: 20
+          unit: MINUTE
+      waf:
+        customInterventionMessage: "Blocked Scammer"
+        ruleSets:
+        - ruleStr: |
+            SecRuleEngine On
+            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
+    routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
+      - matchers:
+          - prefix: /
+        options:
+          extauth:
+            configRef:
+              name: keycloak-oauth
+              namespace: gloo-system
+        routeAction:
+            multi:
+                destinations:
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-productpage-9080
+                          namespace: gloo-system
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-beta-productpage-9080
+                          namespace: gloo-system
 EOF
 ```
 
-Refreshing your browser more than 5 times, you should be able to see a styled HTML page indicating that you reached the limit you have configured before. 
+Refreshing your browser more than 5 times, you should be able to see a styled HTML page indicating that you have reached the limit you had configured before. 
 
 ```
 /opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/get
@@ -1124,7 +1364,15 @@ Refreshing your browser more than 5 times, you should be able to see a styled HT
 
 ### Manipulate the response when a 401 Not Authorized is returned
 
-The following example shows how to create a transformation taking a value from the header and adding it to a response body:
+The following example shows how to create a transformation which modifies the body when the error code is 401 Not Authorized.
+
+This transformation applies to a scenario where you use ExtAuth. Now, you will only simulate the 401.
+
+In Gloo, you can define transformations to happen: 
+- In an `early` stage. Before all filters.
+- In a `regular` stage. After all filters.
+
+> Notice that the response transformation is flagged as `early`. The reason is that an Auth Server returning 401 will cancel any filter or transformation designed to happen after that (`regular` stage). Therefore, you need to prepare the response transformation before the Auth Server filter happens in an `early` stage.
 
 
 ```bash
@@ -1163,6 +1411,65 @@ spec:
             upstream:
               name: team1-httpbin-8000
               namespace: gloo-system
+
+---
+
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: demo
+  namespace: gloo-system
+spec:
+  sslConfig:
+    secretRef:
+      name: upstream-tls
+      namespace: gloo-system  
+  virtualHost:
+    domains:
+      - '*'
+    options:
+      ratelimitBasic:
+        anonymousLimits:
+          requestsPerUnit: 5
+          unit: MINUTE
+        authorizedLimits:
+          requestsPerUnit: 20
+          unit: MINUTE
+      waf:
+        customInterventionMessage: "Blocked Scammer"
+        ruleSets:
+        - ruleStr: |
+            SecRuleEngine On
+            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
+    routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
+      - matchers:
+          - prefix: /
+        options:
+          extauth:
+            configRef:
+              name: keycloak-oauth
+              namespace: gloo-system
+        routeAction:
+            multi:
+                destinations:
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-productpage-9080
+                          namespace: gloo-system
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-beta-productpage-9080
+                          namespace: gloo-system
 EOF
 ```
 
@@ -1178,7 +1485,7 @@ And any other status code, returns the expected body:
 curl -v -k $(glooctl proxy url --port https)/not-secured/status/get
 ```
 
-### Manipulate the response when a 401 Not Authorized is returned
+### Early response transformation
 
 You can also extract information from one header with regular expressions and inject them into another header:
 
@@ -1232,13 +1539,13 @@ spec:
 EOF
 ```
 
-With httbin application, calling `/get`, you can debug the request headers. since you are transforming it to add a new header, after running:
+> With httbin application, calling `/get`, you can debug the request headers. since you are transforming it to add a new header, after running:
 
 ```
-curl -k https://34.141.86.2/not-secured/get -H "x-my-initial-header: Bearer this_is_my_token_for_test"
+curl -k $(glooctl proxy url --port https)/not-secured/get -H "x-my-initial-header: Bearer this_is_my_token_for_test"
 ```
 
-You will see the headers which arrive to the service, including your new transformed one `x-my-final-header` with the specific content after regular expression matching.
+You can see all the request headers which arrive to the service, including your new transformed one `x-my-final-header` with the specific content after regular expression matching.
 
 ```
 {
@@ -1258,10 +1565,43 @@ You will see the headers which arrive to the service, including your new transfo
 ```
 
 
-### Obtain a value from the token
+### Obtain a token from the cookie
+
+In the scenarios when you expose a website, like **bookinfo**, to secure the token (i.e. JWT token in OIDC), you wrap the token with in the cookie.
+
+In this step, you will obtain a token from the cookie:
 
 ```bash
 kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+# ---------------- Transformation ------------------          
+        transformations:
+          responseTransformation:
+            transformationTemplate:
+              parseBodyBehavior: DontParse
+              body: 
+                text: '{% if header(":status") == "429" %}<html><body style="background-color:powderblue;"><h1>Too many Requests!</h1><p>Try again after 1 minute</p></body></html>{% else %}{{ body() }}{% endif %}'
+#---------------------------------------------------
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -1315,6 +1655,8 @@ This transformation is using a regular expression to extract the JWT token from
 
 As explained in previous Labs, Keycloak will return a JWT token, so we’ll use Gloo to extract some claims from this token and to create new headers corresponding to these claims.
 
+TODO: HEREEEEEEEEEEEEEE
+
 Finally, we’ll see how Gloo Edge RBAC rules can be created to leverage the claims contained in the JWT token.
 
 

From 21b68798a50646e9eef193ae89d24c9f9559d8b4 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Thu, 22 Jul 2021 18:31:26 +0200
Subject: [PATCH 08/28] Improve other labs

---
 gloo-edge/gloo-edge/README.md | 673 ++++++++++++++++++++++++----------
 1 file changed, 489 insertions(+), 184 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 5c21ae41f3..ca1937687e 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -9,15 +9,15 @@ The goal of this workshop is to expose some key features of Gloo API Gateway, li
 The lab environment consists of a Kubernetes environment deployed locally using kind.
 
 In this workshop we will:
-TODO: Redo summary
-* Deploy a demo application (Istio's [bookinfo](https://istio.io/latest/docs/examples/bookinfo/) demo app) on a k8s cluster and expose it through Gloo Edge
-* Deploy a second version of the demo app and route traffic to both versions
-* Secure the demo app using TLS
-* Secure the demo app using OIDC
-* Rate limit the traffic going to the demo app
-* Transform a response using Gloo transformations
+* Deploy two applications (Istio's **[bookinfo](https://istio.io/latest/docs/examples/bookinfo/)** and **[httpbin](https://github.com/istio/istio/blob/master/samples/httpbin/httpbin.yaml)**) on a k8s cluster and expose it through Gloo Edge
+* Deploy a second version of the **bookinfo** app and route traffic to both versions
+* Secure apps using TLS
+* Apply Authentication using OIDC
+* Rate limit the traffic going to the apps
+* Apply rules for the Web Application Firewall (WAF)
+* Transform requests, responses and bodies using Gloo transformations
+* Apply Authorization using RBAC and OPA (Open Policy Agent)
 * Configure access logs
-* Use several of these features together to configure an advanced OIDC workflow
 
 ## Lab 0: Demo Environment Creation
 
@@ -70,11 +70,11 @@ done
 
 ## Lab 1: Traffic Management
 
-### Deploy Demo Services
+### Deploy Services
 
-In this step we will expose two demo services to the outside world using Gloo Edge.
+In this step you will expose two services to the outside world using Gloo Edge.
 
-First let's deploy a demo application called **bookinfo** in `bookinfo` namespace:
+First let's deploy an application called **bookinfo** in `bookinfo` namespace:
 
 ```bash
 kubectl create ns bookinfo 
@@ -84,7 +84,7 @@ kubectl delete deployment reviews-v1 reviews-v3 -n bookinfo
  
 ![Gloo Edge with Bookinfo](images/bookinfo-v2.png)
 
-The bookinfo app has 3 versions of a microservice called reviews.  We will keep only the version 2 of the reviews microservice for this step and will add the other versions later.  An easy way to distinguish among the different versions in the web interface is to look at the stars: v1 displays no stars in the reviews, v2 displays black stars, and v3 displays red stars.
+The bookinfo app has 3 versions of a microservice called reviews.  You will keep only the version 2 of the reviews microservice for this step and will add the other versions later.  An easy way to distinguish among the different versions in the web interface is to look at the stars: v1 displays no stars in the reviews, v2 displays black stars, and v3 displays red stars.
 
 
 Gloo Edge uses a discovery mechanism to create Upstreams automatically, but Upstreams can be also created manually using Kubernetes CRDs.
@@ -203,7 +203,7 @@ Now that your two Upstream CR have been created, you need to create the resource
 
 First, you create a Virtual Service. For bookinfo under `/` and for httpbin under `/not-secured`.
 
-Please, notice that the oder matters.
+Please, notice that the order matters.
 
 ```bash
 kubectl apply -f - <<EOF
@@ -229,7 +229,7 @@ EOF
 
 The creation of the Virtual Service exposes the Kubernetes service through the gateway.
 
-We can access the application using the web browser by running the following command:
+You can access the application using the web browser by running the following command:
 
 ```
 /opt/google/chrome/chrome $(glooctl proxy url)/productpage
@@ -280,7 +280,7 @@ And to access the httpbin application:
 /opt/google/chrome/chrome $(glooctl proxy url)/not-secured/get
 ```
 
-It should return the a json object with details regarding your own request. Something similar to:
+It should return a json object with details regarding your own request. Something similar to:
 
 ```
 {
@@ -313,7 +313,7 @@ Use cases for delegation include:
 - Simplifying very large routing configurations for a single Virtual Service
 - Restricting ownership of routing configuration for a tenant to a subset of the whole Virtual Service.
 
-Let's rewrite our Virtual Service to delegate the routing to a Route Table.
+Let's rewrite your Virtual Service to delegate the routing to a Route Table.
 
 First resource is the delegated Route Table. Second resource is a Virtual Service. Notice that there is a new `delegateAction` referencing the just created Route Table.
 
@@ -433,9 +433,9 @@ EOF
 
 ### Routing to Multiple Upstreams
 
-In many cases, we need to route traffic to two different versions of an application to test a new feature. In this step, we are going to update the Virtual Service to route traffic to two different Upstreams:
+In many cases, you need to route traffic to two different versions of an application to test a new feature. In this step, you are going to update the Virtual Service to route traffic to two different Upstreams:
 
-The first step is to create a new deployment of the demo application, this time with the version 3 of the reviews microservice: 
+The first step is to create a new deployment of the **bookinfo** application, this time with the version 3 of the reviews microservice: 
 
 ```bash
 kubectl create ns bookinfo-beta 
@@ -519,7 +519,7 @@ spec:
 EOF
 ```
 
-We should see either the **black** star reviews (v2) or the new **red** star reviews (v3) when refreshing the page.
+You should see either the **black** star reviews (v2) or the new **red** star reviews (v3) when refreshing the page.
 
 ![Bookinfo Web Interface](images/2.png)
 
@@ -529,9 +529,9 @@ In this lab, you will explore some Gloo Edge features related to security and Au
 
 ### Network Encryption - Server TLS
 
-In this step you are going to secure you demo application using TLS.
+In this step you are going to secure your application using TLS.
 
-Let's first create a private key and a self-signed certificate to use in your demo Virtual Service:
+Let's first create a private key and a self-signed certificate to use in your Virtual Service:
 
 ```bash
 openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
@@ -631,7 +631,7 @@ The browser will warn you that your connection is not private due to the self-si
 
 And **httpbin**:
 
-> Since you are using self-signed certificates, you need to allow insecure sever connection when using SSL with *-k*
+> Since you are using self-signed certificates, you need to allow insecure server connection when using SSL with *-k*
 
 ```
 curl -k $APP_URL/not-secured/get
@@ -645,7 +645,7 @@ OIDC (OpenID Connect) is an identity layer on top of the OAuth 2.0 protocol. In
 The goal of OIDC is to address this ambiguity by additionally requiring Identity Providers to return a well-defined ID Token. OIDC ID tokens follow the JSON Web Token standard and contain specific fields that your applications can expect and handle. This standardization allows you to switch between Identity Providers – or support multiple ones at the same time – with minimal, if any, changes to your downstream services; it also allows you to consistently apply additional security measures like Role-based Access Control (RBAC) based on the identity of your users, i.e. the contents of their ID token.
 
 
-In this step, you will secure **bookinfo** application using an OIDC Identity Provider.
+In this step, you will secure the **bookinfo** application using an OIDC Identity Provider.
 
 Let's start by installing Keycloak:
 
@@ -658,7 +658,7 @@ kubectl rollout status deploy/keycloak
 sleep 30
 -->
 
-Then, we need to configure it and create two users:
+Then, you need to configure it and create two users:
 
 - User1 credentials: `user1/password`
   Email: user1@solo.io
@@ -702,10 +702,10 @@ The architecture looks like this now:
 
 ![Bookinfo with OIDC](images/bookinfo-oidc.png)
 
-The next step is to configure the authentication in the Virtual Service. For this we will have to create a Kubernetes Secret that contains the OIDC secret:
+The next step is to configure the authentication in the Virtual Service. For this, you will have to create a Kubernetes Secret that contains the OIDC secret:
 
 ```bash
-glooctl create secret oauth --namespace gloo-system --name keycloak-oauth --client-secret ${secret}
+glooctl create secret oauth --namespace gloo-system --name oauth --client-secret ${secret}
 ```
 
 Then you will create an AuthConfig, which is a Gloo Edge CRD that contains authentication information: 
@@ -715,7 +715,7 @@ kubectl apply -f - <<EOF
 apiVersion: enterprise.gloo.solo.io/v1
 kind: AuthConfig
 metadata:
-  name: keycloak-oauth
+  name: oauth
   namespace: gloo-system
 spec:
   configs:
@@ -725,7 +725,7 @@ spec:
         callbackPath: /callback
         clientId: ${client}
         clientSecretRef:
-          name: keycloak-oauth
+          name: oauth
           namespace: gloo-system
         issuerUrl: "${KEYCLOAK_URL}/realms/master/"
         scopes:
@@ -735,7 +735,7 @@ EOF
 
 Finally you activate the authentication on the Virtual Service by referencing the AuthConfig:
 
-> Notice that this only applies to a specif route, because it is configured within a **matcher**
+> Notice that this only applies to a specific route, because it is configured within a **matcher**
 
 ```bash
 kubectl apply -f - <<EOF
@@ -788,7 +788,7 @@ spec:
         options:
           extauth:
             configRef:
-              name: keycloak-oauth
+              name: oauth
               namespace: gloo-system
 # ---------------------------------------------------------------------------
         routeAction:
@@ -808,7 +808,7 @@ spec:
 EOF
 ```
 
-To test the Authentication, try first to access **httpbin** application. You will see that Authentication is NOT required.
+To test the Authentication, try first to access the **httpbin** application. You will see that Authentication is NOT required.
 
 ```
 curl -k $APP_URL/not-secured/get
@@ -905,7 +905,7 @@ spec:
         options:
           extauth:
             configRef:
-              name: keycloak-oauth
+              name: oauth
               namespace: gloo-system
 # ---------------- Rate limit config ------------------
           rateLimitConfigs:
@@ -1010,7 +1010,7 @@ spec:
         options:
           extauth:
             configRef:
-              name: keycloak-oauth
+              name: oauth
               namespace: gloo-system
         routeAction:
             multi:
@@ -1050,7 +1050,7 @@ A web application firewall (WAF) protects web applications by monitoring, filter
 
 Gloo Edge Enterprise includes the ability to enable the ModSecurity Web Application Firewall for any incoming and outgoing HTTP connections. 
 
-Let's update the Virtual Service to restrict requests with huge payload to avoid *Large Payload Post DDoS Attack*. The intention of this DDoS attack is abuse on the amount of memory used to decode the payload bringing the server down.
+Let's update the Virtual Service to restrict requests with huge payloads to avoid *Large Payload Post DDoS Attacks*. The intention of this DDoS attack is abuse of the amount of memory used to decode the payload bringing the server down.
 
 ```bash
 kubectl apply -f - <<EOF
@@ -1119,7 +1119,7 @@ spec:
         options:
           extauth:
             configRef:
-              name: keycloak-oauth
+              name: oauth
               namespace: gloo-system
         routeAction:
             multi:
@@ -1137,7 +1137,7 @@ spec:
 EOF
 ```
 
-The rule means that the request body's size cannot be greater than 1KB.
+The rule means that the request body size cannot be greater than 1KB.
 
 Run following command to test it:
 
@@ -1224,7 +1224,7 @@ spec:
         options:
           extauth:
             configRef:
-              name: keycloak-oauth
+              name: oauth
               namespace: gloo-system
         routeAction:
             multi:
@@ -1264,7 +1264,7 @@ In this section you will explore how to transform requests and responses using G
 
 Before, it was mentioned that **httpbin** is a good tool to debug and test things out. In this section, you will use that application to easily spot the results.
 
-Following example demonstrates how to modify a response using Gloo Edge. We are going to return a basic html page when the response code is 429 (rate limited).  
+Following example demonstrates how to modify a response using Gloo Edge. You are going to return a basic html page when the response code is 429 (rate limited).  
 
 ```bash
 kubectl apply -f - <<EOF
@@ -1338,7 +1338,7 @@ spec:
         options:
           extauth:
             configRef:
-              name: keycloak-oauth
+              name: oauth
               namespace: gloo-system
         routeAction:
             multi:
@@ -1455,7 +1455,7 @@ spec:
         options:
           extauth:
             configRef:
-              name: keycloak-oauth
+              name: oauth
               namespace: gloo-system
         routeAction:
             multi:
@@ -1473,7 +1473,7 @@ spec:
 EOF
 ```
 
-With httbin application, you can simulate that the server returns a 401 status code. Let's run it and see that calling `/status/401`, the returned body is what we expected
+With the **httbin** application, you can simulate that the server returns a 401 status code. Let's run it and see that calling `/status/401`, the returned body is what you expected
 
 ```
 curl -v -k $(glooctl proxy url --port https)/not-secured/status/401
@@ -1536,40 +1536,97 @@ spec:
             upstream:
               name: team1-httpbin-8000
               namespace: gloo-system
+
+---
+
+apiVersion: gateway.solo.io/v1
+kind: VirtualService
+metadata:
+  name: demo
+  namespace: gloo-system
+spec:
+  sslConfig:
+    secretRef:
+      name: upstream-tls
+      namespace: gloo-system  
+  virtualHost:
+    domains:
+      - '*'
+    options:
+      ratelimitBasic:
+        anonymousLimits:
+          requestsPerUnit: 5
+          unit: MINUTE
+        authorizedLimits:
+          requestsPerUnit: 20
+          unit: MINUTE
+      waf:
+        customInterventionMessage: "Blocked Scammer"
+        ruleSets:
+        - ruleStr: |
+            SecRuleEngine On
+            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
+    routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
+      - matchers:
+          - prefix: /
+        options:
+          extauth:
+            configRef:
+              name: oauth
+              namespace: gloo-system
+        routeAction:
+            multi:
+                destinations:
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-productpage-9080
+                          namespace: gloo-system
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-beta-productpage-9080
+                          namespace: gloo-system
 EOF
 ```
 
-> With httbin application, calling `/get`, you can debug the request headers. since you are transforming it to add a new header, after running:
+> With the **httbin** application, calling `/get`, you can debug the request headers. since you are transforming it to add a new header, after running:
 
 ```
 curl -k $(glooctl proxy url --port https)/not-secured/get -H "x-my-initial-header: Bearer this_is_my_token_for_test"
 ```
 
-You can see all the request headers which arrive to the service, including your new transformed one `x-my-final-header` with the specific content after regular expression matching.
+You can see the new `X-My-Final-Header` header only with the token:
 
 ```
 {
-  "args": {}, 
   "headers": {
-    "Accept": "*/*", 
-    "Host": "x.x.x.x", 
-    "User-Agent": "curl/7.64.1", 
-    "X-Envoy-Expected-Rq-Timeout-Ms": "15000", 
-    "X-Envoy-Original-Path": "/not-secured/get", 
+[...]
     "X-My-Final-Header": "this_is_my_token_for_test", 
     "X-My-Initial-Header": "Bearer this_is_my_token_for_test"
   }, 
-  "origin": "x.x.x.x", 
-  "url": "xxxxxxxxx"
+[...]
 }
 ```
 
 
 ### Obtain a token from the cookie
 
-In the scenarios when you expose a website, like **bookinfo**, to secure the token (i.e. JWT token in OIDC), you wrap the token with in the cookie.
+In the scenarios when you expose a website, like **bookinfo**, to secure the token (i.e. JWT token in OIDC), you wrap the token within the cookie.
+
+In this step, you will obtain a token from the cookie.
+
+For the purpose of the demo, you will apply this transformation in the general location. That means that the transformation will be applied for all the routes. In your case, the applications you have deployed.
 
-In this step, you will obtain a token from the cookie:
+> Notice that the previous transformations have been commented out. The reason is that transformations in lower levels like at Route Table are prioritized to the more general ones like the one in the Virtual Service.
 
 ```bash
 kubectl apply -f - <<EOF
@@ -1586,14 +1643,33 @@ spec:
         - prefix: /not-secured
       options:
         prefixRewrite: '/'
-# ---------------- Transformation ------------------          
-        transformations:
-          responseTransformation:
-            transformationTemplate:
-              parseBodyBehavior: DontParse
-              body: 
-                text: '{% if header(":status") == "429" %}<html><body style="background-color:powderblue;"><h1>Too many Requests!</h1><p>Try again after 1 minute</p></body></html>{% else %}{{ body() }}{% endif %}'
-#---------------------------------------------------
+# ------------- Commenting transformations ------------------
+        # stagedTransformations:
+        #   early:
+        #     responseTransforms:
+        #     - responseTransformation:
+        #         transformationTemplate:
+        #           parseBodyBehavior: DontParse
+        #           headers:
+        #             Content-type: 
+        #               text: "application/json"
+        #           body:
+        #               text: |
+        #                     {% if header(":status") == "401" %} 
+        #                     Hold the horses! You are not authenticated
+        #                     {% else %}{{ body() }}{% endif %}
+        #     requestTransforms:       
+        #     - requestTransformation:
+        #         transformationTemplate:
+        #           extractors:
+        #             apiKey:
+        #               header: 'x-my-initial-header'
+        #               regex: '^Bearer (.*)$'
+        #               subgroup: 1
+        #           headers:
+        #             x-my-final-header:
+        #               text: '{{ apiKey }}'
+#------------------------------------------------------------- 
       routeAction:
           single:
             upstream:
@@ -1613,12 +1689,23 @@ spec:
       name: upstream-tls
       namespace: gloo-system  
   virtualHost:
+    domains:
+      - '*'
     options:
-      extauth:
-        configRef:
-          name: keycloak-oauth
-          namespace: gloo-system
-# -------------Extract Token------------------
+      ratelimitBasic:
+        anonymousLimits:
+          requestsPerUnit: 5
+          unit: MINUTE
+        authorizedLimits:
+          requestsPerUnit: 20
+          unit: MINUTE
+      waf:
+        customInterventionMessage: "Blocked Scammer"
+        ruleSets:
+        - ruleStr: |
+            SecRuleEngine On
+            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
+# ------------- Transformation to Extract Token ------------------
       stagedTransformations:
         early:
           requestTransforms:
@@ -1633,99 +1720,120 @@ spec:
                     jwt:
                       text: '{{ token }}'
 #--------------------------------------------- 
-#--------------Remove Header------------------ 
+#-------------- Remove Cookie Header ------------------ 
       headerManipulation:
         requestHeadersToRemove:
         - "cookie"
 #--------------------------------------------- 
-    domains:
-      - '*'
     routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
       - matchers:
           - prefix: /
+        options:
+          extauth:
+            configRef:
+              name: oauth
+              namespace: gloo-system
         routeAction:
-            single:
-              upstream:
-                name: default-httpbin-8000
-                namespace: gloo-system
+            multi:
+                destinations:
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-productpage-9080
+                          namespace: gloo-system
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-beta-productpage-9080
+                          namespace: gloo-system
 EOF
 ```
 
 This transformation is using a regular expression to extract the JWT token from the `cookie` header, creates a new `jwt` header that contains the token and removes the `cookie` header.
 
-As explained in previous Labs, Keycloak will return a JWT token, so we’ll use Gloo to extract some claims from this token and to create new headers corresponding to these claims.
-
-TODO: HEREEEEEEEEEEEEEE
-
-Finally, we’ll see how Gloo Edge RBAC rules can be created to leverage the claims contained in the JWT token.
-
-
-As you can see, the browser has sent the cookie as a header in the HTTP request.
-
-
-### Getting more details from token
-
+As explained in previous Labs, Keycloak will return a JWT token, so you’ll use Gloo to extract some claims from this token and to create new headers corresponding to these claims.
 
+To test this, first you will need to obtain a valid token through your **bookinfo** application:
 
+```
+/opt/google/chrome/chrome $(glooctl proxy url)/productpage
+```
 
-Gloo is able to perform advanced transformations of the request and response.
+After refreshing, and maybe signing in, you will access the application again, which means that you will have the valid token in a cookie.
 
-Let’s modify the Virtual Service using the yaml below:
+Now, let's verify the transformation using the debugging **httpbin** application. This time, in the browser:
 
 
+```
+/opt/google/chrome/chrome $(glooctl proxy url)/not-secured/get
+```
 
-Here is the output you should get if you refresh the web page:
+As you can see, the browser has sent the cookie as a header in the HTTP request. And after transformation, your debugging application shows you that there is a new header with the token. Something like this:
 
 ```
 {
-  "args": {}, 
-  "headers": {
-    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", 
-    "Accept-Encoding": "gzip, deflate, br", 
-    "Accept-Language": "en-US,en;q=0.9", 
-    "Cache-Control": "max-age=0", 
-    "Content-Length": "0", 
-    "Host": "172.18.1.1", 
-    "Jwt": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJZd18zVTBoOFFkbGpsODBiSkQxUDhzbUtud0ZYYkVJZE0xZjlMU3R1N2E0In0.eyJleHAiOjE2MDc0MTkyOTMsImlhdCI6MTYwNzQxOTIzMywiYXV0aF90aW1lIjoxNjA3NDE4NzQ5LCJqdGkiOiI2NWExYzM0Ni0wNTY5LTQwNWUtYTNmZi0wOTVjZGE3MGRiYmMiLCJpc3MiOiJodHRwOi8vMTcyLjE4LjAuMjExOjgwODAvYXV0aC9yZWFsbXMvbWFzdGVyIiwiYXVkIjoiZjg3YzAzOWQtNTdiZi00NTQzLWExZjAtOGIyMmZjNmY5ZTYwIiwic3ViIjoiN2Q0N2I2YmYtOTcyYi00OGRjLWI3YjctM2U5N2NlZGM4NjM1IiwidHlwIjoiSUQiLCJhenAiOiJmODdjMDM5ZC01N2JmLTQ1NDMtYTFmMC04YjIyZmM2ZjllNjAiLCJzZXNzaW9uX3N0YXRlIjoiOGJmNjAzMTYtY2NmYi00ZWZkLWFiNDgtOTc5MmQzNTkzNzBhIiwiYXRfaGFzaCI6IkV5ZUtXbjhELWdZQlIxOWhpaEg2YXciLCJhY3IiOiIwIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ1c2VyMSIsImVtYWlsIjoidXNlcjFAc29sby5pbyIsImdyb3VwIjoidXNlcnMifQ.nrwvo8F1jKjyQCED95gLYAvYi9TxRRDW6_Z8WC8c61WU1hHUMsHJG77G-CG0T8NwORG2cB7dlP3iu_M_e9BaONCsCZsUZUCpwV5w7ZsFxbbMy4jWSuQyd38kTnoFyMHQGxCXGI0VS02TqsAaO6oQIjwoC6Ib_6MKxsgYNrIGhp7FihO7D1rfBW-Ggvqx88INFSMCKWOft6xzYvBS6JQcDjLXMAkc4TOmTBFZkfXpepsKlDjFxW5DreaDZXv1zIUM-dG-1MRk_N5CPg_OWgnjiF4gKWTqCG8hJd__QPwo4RO7FqM5BM8o0u_lugNbgHlB-09GjO7NTZiZHiQB3HxWVw", 
-    "Sec-Fetch-Dest": "document", 
-    "Sec-Fetch-Mode": "navigate", 
-    "Sec-Fetch-Site": "none", 
-    "Sec-Fetch-User": "?1", 
-    "Upgrade-Insecure-Requests": "1", 
-    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36", 
-    "X-Envoy-Expected-Rq-Timeout-Ms": "15000", 
-    "X-User-Id": "http://172.18.1.2:8080/auth/realms/master;7d47b6bf-972b-48dc-b7b7-3e97cedc8635"
-  }, 
-  "origin": "192.168.149.15", 
-  "url": "https://172.18.1.1/get"
+"args": {},
+"headers": {
+[...]
+"X-Envoy-Original-Path": "/not-secured/get",
+"Jwt": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJMN3duMjIwNEVGbUVOanpTRkxzUl85SWVvT3BHQTdCYl9rbTZqRGo1OHVZIn0.eyJleHAiOjE2MjY5NTkxMDUsImlhdCI6MTYyNjk1OTA0NSwiYXV0aF90aW1lIjoxNjI2OTU3NjU5LCJqdGkiOiI4M2Y3MDM5MS1mNWUzLTRmM2QtYjEzNi05YzZiZjZmYjYxODUiLCJpc3MiOiJodHRwOi8vMzQuMTQxLjk5LjYyOjgwODAvYXV0aC9yZWFsbXMvbWFzdGVyIiwiYXVkIjoiYjdkN2VjNWEtNDQ0Mi00OTM5LTg4NDMtMGJkYjlhNWM1MTQyIiwic3ViIjoiOThlMTM3ZWYtNTM2YS00NTkwLWE2NDctNDU1MmZiMmU3OThhIiwidHlwIjoiSUQiLCJhenAiOiJiN2Q3ZWM1YS00NDQyLTQ5MzktODg0My0wYmRiOWE1YzUxNDIiLCJzZXNzaW9uX3N0YXRlIjoiODRlMDQzMjgtNjAyZC00MmRkLWJiMmMtOGFkYWUzODk5ZThlIiwiYXRfaGFzaCI6IlpiWGdIMGZjdlVfTWJibC16ZmFOTVEiLCJhY3IiOiIwIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ1c2VyMSIsImVtYWlsIjoidXNlcjFAc29sby5pbyIsImdyb3VwIjoidXNlcnMifQ.auGfDKVg7ULeAVj5HVVNhoW-o-0jh3dzS4_ZOZC_YiP7tD5ku4ul9Ay8Qv9tERNKRyXSOegR43uAxE9fRXagqgbFplgUwQmF0bOUr-0tPukDT94_Qxf4OlL4znTEYWXWnSLPosTpSqvRZOrDq87OZv_KFcEVu97Bj04quMQVhOQMw1znv_jctKKZfBE32hDY7NkgJPWHRJ7etNPYrZmFVk2PYmycI_nwCFerm6zs7jEsiweLbnvUjVe8nNbjngoGsZyzfz3dV5nBWJ0ibkNY_Sea-hK691p_MCZn7IR5mCxkuXA93Vcw4olkAV45bACfRebBP9eUY_rojkBgYC843A"
+},
+[...]
 }
 ```
 
-You can see that the `Jwt` header has been added to the request while the cookie header has been removed.
+Also notice that there is no `cookie` header sent to the back-end anymore.
+
 
-### Inspect the JWT token claims
+### Extract information from the JWT token
 
-The JWT token contains a number of claims that we can use to drive RBAC decisions and potentially to provide other input to our upstream systems.
+The JWT token contains a number of claims that you can use to drive RBAC decisions and potentially to provide other input to your upstream systems.
 
 In this case, let's take a closer look at the claims that the Keycloak-generated JWT provides us.  Paste the text of the `Jwt` header into the `Encoded` block at [jwt.io](https://jwt.io), and it will show you the full set of claims available.
 
 ![JWT Claims](images/jwt-claims.png)
 
-### Extract information from the JWT token
-
-JWKS is a set of public keys that can be used to verify the JWT tokens.
+Let's obtain those claims.
 
-First, we need to assign the value to a variable of the keycloak master realm.   
+First, you need to assign the value to a variable of the keycloak master realm.   
 
 ```bash
 KEYCLOAK_MASTER_REALM_URL=http://$(kubectl get svc keycloak -ojsonpath='{.status.loadBalancer.ingress[0].ip}'):8080/auth/realms/master
 ```
 
-
-Now, we can update the Virtual Service to validate the token, extract claims from the token and create new headers based on these claims.
+Now, you can update the resources to validate the token, extract claims from the token and create new headers based on these claims.
 
 ```bash
 kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -1737,11 +1845,22 @@ spec:
       name: upstream-tls
       namespace: gloo-system  
   virtualHost:
+    domains:
+      - '*'
     options:
-      extauth:
-        configRef:
-          name: keycloak-oauth
-          namespace: gloo-system
+      ratelimitBasic:
+        anonymousLimits:
+          requestsPerUnit: 5
+          unit: MINUTE
+        authorizedLimits:
+          requestsPerUnit: 20
+          unit: MINUTE
+      waf:
+        customInterventionMessage: "Blocked Scammer"
+        ruleSets:
+        - ruleStr: |
+            SecRuleEngine On
+            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
       stagedTransformations:
         early:
           requestTransforms:
@@ -1763,9 +1882,10 @@ spec:
         providers:
           keycloak:
             issuer: ${KEYCLOAK_MASTER_REALM_URL}
+            keepToken: true
             tokenSource:
               headers:
-              - header: Jwt
+              - header: jwt
             claimsToHeaders:
             - claim: email
               header: x-solo-claim-email
@@ -1778,44 +1898,62 @@ spec:
                   name: default-keycloak-8080
                   namespace: gloo-system
 #--------------------------------------------- 
-    domains:
-      - '*'
     routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
       - matchers:
           - prefix: /
+        options:
+          extauth:
+            configRef:
+              name: oauth
+              namespace: gloo-system
         routeAction:
-            single:
-              upstream:
-                name: default-httpbin-8000
-                namespace: gloo-system
+            multi:
+                destinations:
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-productpage-9080
+                          namespace: gloo-system
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-beta-productpage-9080
+                          namespace: gloo-system
 EOF
 ```
 
+Once again, you need to refresh your **bookinfo** application to refresh the token in case it expires.
+
+```
+/opt/google/chrome/chrome $(glooctl proxy url)/productpage
+```
+
+And now, let's see the results with the fresh token:
+
+```
+/opt/google/chrome/chrome $(glooctl proxy url)/not-secured/get
+```
+
 Here is the output you should get if you refresh the web page:
 
 ```
 {
   "args": {}, 
   "headers": {
-    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", 
-    "Accept-Encoding": "gzip, deflate, br", 
-    "Accept-Language": "en-US,en;q=0.9", 
-    "Cache-Control": "max-age=0", 
-    "Content-Length": "0", 
-    "Host": "172.18.1.1", 
-    "Sec-Fetch-Dest": "document", 
-    "Sec-Fetch-Mode": "navigate", 
-    "Sec-Fetch-Site": "cross-site", 
-    "Sec-Fetch-User": "?1", 
-    "Upgrade-Insecure-Requests": "1", 
-    "User-Agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36", 
-    "X-Envoy-Expected-Rq-Timeout-Ms": "15000", 
+[...]
     "X-Solo-Claim-Email": "user1@solo.io", 
     "X-Solo-Claim-Email-Verified": "false", 
-    "X-User-Id": "http://172.18.1.2:8080/auth/realms/master;7d47b6bf-972b-48dc-b7b7-3e97cedc8635"
+[...]
   }, 
-  "origin": "192.168.149.15", 
-  "url": "https://172.18.1.1/get"
+[...]
 }
 ```
 
@@ -1823,14 +1961,41 @@ As you can see, Gloo Edge has added the `x-solo-claim-email` and `x-solo-claim-e
 
 It will allow the application to know the user's email identity and if that email has been verified.
 
+## Lab 6: Authorization
+
+Gloo can also integrate with different mechanisms to provide Authorization level.
+
 ### RBAC using the claims of the JWT token
 
-Gloo Edge can also be used to set RBAC rules based on the claims of the JWT token returned by the identity provider.
+You can set RBAC rules based on the claims of the JWT token returned by the identity provider.
 
-Let’s update the Virtual Service as follow:
+In the following example, you are going to configure RBAC policies for all routes. But you are going to disable it for the **bookinfo** application.
+
+Thus, the RBAC policies will be applied to the **httpbin** application.
 
 ```bash
 kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -1842,11 +2007,22 @@ spec:
       name: upstream-tls
       namespace: gloo-system  
   virtualHost:
+    domains:
+      - '*'
     options:
-      extauth:
-        configRef:
-          name: keycloak-oauth
-          namespace: gloo-system
+      ratelimitBasic:
+        anonymousLimits:
+          requestsPerUnit: 5
+          unit: MINUTE
+        authorizedLimits:
+          requestsPerUnit: 20
+          unit: MINUTE
+      waf:
+        customInterventionMessage: "Blocked Scammer"
+        ruleSets:
+        - ruleStr: |
+            SecRuleEngine On
+            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
       stagedTransformations:
         early:
           requestTransforms:
@@ -1865,11 +2041,12 @@ spec:
         - "cookie"
       jwt:
         providers:
-          dex:
+          keycloak:
             issuer: ${KEYCLOAK_MASTER_REALM_URL}
+            keepToken: true
             tokenSource:
               headers:
-              - header: Jwt
+              - header: jwt
             claimsToHeaders:
             - claim: email
               header: x-solo-claim-email
@@ -1881,55 +2058,89 @@ spec:
                 upstreamRef:
                   name: default-keycloak-8080
                   namespace: gloo-system
-#--------------Add RBAC rule------------------
+#-------------- Add RBAC rule for all routes ------------------
       rbac:
         policies:
           viewer:
             permissions:
               methods:
               - GET
-              pathPrefix: /get
+              pathPrefix: /not-secured/get
             principals:
             - jwtPrincipal:
                 claims:
                   email: user1@solo.io
-#--------------------------------------------- 
-    domains:
-      - '*'
+#----------------------------------------------- 
     routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
       - matchers:
           - prefix: /
+        options:
+#-------------- Disable RBAC for this route ------------------
+          rbac:
+            disable: true
+#-------------------------------------------------------------
+          extauth:
+            configRef:
+              name: oauth
+              namespace: gloo-system
         routeAction:
-            single:
-              upstream:
-                name: default-httpbin-8000
-                namespace: gloo-system
+            multi:
+                destinations:
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-productpage-9080
+                          namespace: gloo-system
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-beta-productpage-9080
+                          namespace: gloo-system
 EOF
 ```
 
-If you refresh the web page, you should still get the same response you got before.
+If you refresh the **bookinfo** web page, you should still get the same response you got before.
 
-But if you change the path to anything that doesn't start with `/get`, you should get the following response:
+But if you access the **httpbin** and change the path to anything that doesn't start with `/not-secured/get`, you should get the following response.
 
 ```
 RBAC: access denied
 ```
 
+Let's compare:
+
+```
+/opt/google/chrome/chrome $(glooctl proxy url)/not-secured/get
+```
+
+```
+/opt/google/chrome/chrome $(glooctl proxy url)/not-secured/anything
+```
+
+
+
 ### RBAC using OPA
 
 Gloo Edge can also be used to set RBAC rules based on [OPA (Open Policy Agent)](https://www.openpolicyagent.org/) and its rego rules.
 
-This model allows you to get fine-grained control over the Authorization on your applications. As well, this model is well adopted by the kubernetes community.
-
+This model allows you to get fine-grained control over the Authorization in your applications. As well, this model is well adopted by the kubernetes community.
 
-Let's delete the existing `AuthConfig` and create another one with two configurations:
+Let's add another configuration to the `AuthConfig` you created in previous Labs:
 
 ```bash
 kubectl apply -f - <<EOF
 apiVersion: enterprise.gloo.solo.io/v1
 kind: AuthConfig
 metadata:
-  name: keycloak-oauth
+  name: oauth
   namespace: gloo-system
 spec:
   configs:
@@ -1939,12 +2150,12 @@ spec:
         callbackPath: /callback
         clientId: ${client}
         clientSecretRef:
-          name: keycloak-oauth
+          name: oauth
           namespace: gloo-system
         issuerUrl: "${KEYCLOAK_URL}/realms/master/"
         scopes:
         - email
-  - opa_auth:
+  - opaAuth:
       modules:
       - name: allow-solo-email-users
         namespace: gloo-system
@@ -1979,10 +2190,31 @@ EOF
 
 Notice that this rule will allow only users with email ending with `@solo.io`
 
-Finally, let's update the Virtual Service:
+Finally, let's update the resources. You will disable RBAC to not interfere with this authorization mechanism:
 
 ```bash
 kubectl apply -f - <<EOF
+apiVersion: gateway.solo.io/v1
+kind: RouteTable
+metadata:
+  name: httpbin-routetable
+  namespace: team1
+  labels:
+    application-owner: team1
+spec:
+  routes:
+    - matchers:
+        - prefix: /not-secured
+      options:
+        prefixRewrite: '/'
+      routeAction:
+          single:
+            upstream:
+              name: team1-httpbin-8000
+              namespace: gloo-system
+
+---
+
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -1992,30 +2224,103 @@ spec:
   sslConfig:
     secretRef:
       name: upstream-tls
-      namespace: gloo-system
+      namespace: gloo-system  
   virtualHost:
-    options:
-      extauth:
-        configRef:
-          name: keycloak-oauth
-          namespace: gloo-system
     domains:
       - '*'
+    options:
+      ratelimitBasic:
+        anonymousLimits:
+          requestsPerUnit: 5
+          unit: MINUTE
+        authorizedLimits:
+          requestsPerUnit: 20
+          unit: MINUTE
+      waf:
+        customInterventionMessage: "Blocked Scammer"
+        ruleSets:
+        - ruleStr: |
+            SecRuleEngine On
+            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
+      stagedTransformations:
+        early:
+          requestTransforms:
+            - requestTransformation:
+                transformationTemplate:
+                  extractors:
+                    token:
+                      header: 'cookie'
+                      regex: 'id_token=(.*); .*'
+                      subgroup: 1
+                  headers:
+                    jwt:
+                      text: '{{ token }}'
+      headerManipulation:
+        requestHeadersToRemove:
+        - "cookie"
+      jwt:
+        providers:
+          keycloak:
+            issuer: ${KEYCLOAK_MASTER_REALM_URL}
+            keepToken: true
+            tokenSource:
+              headers:
+              - header: jwt
+            claimsToHeaders:
+            - claim: email
+              header: x-solo-claim-email
+            - claim: email_verified
+              header: x-solo-claim-email-verified
+            jwks:
+              remote:
+                url: http://keycloak.default.svc:8080/auth/realms/master/protocol/openid-connect/certs
+                upstreamRef:
+                  name: default-keycloak-8080
+                  namespace: gloo-system
+#-------------- RBAC is disabled to not interfere with OPA ------------------
+      rbac:
+        disable: true
+#-------------------------------------------------------------------------- 
     routes:
+      - matchers:
+          - prefix: /not-secured
+        delegateAction:
+          selector:
+            namespaces:
+              - team1
+            labels:
+              application-owner: team1
       - matchers:
           - prefix: /
-        routeAction:
-          single:
-            upstream:
-              name: default-httpbin-8000
+        options:
+#-------------- RBAC is disabled to not interfere with OPA ------------------
+          rbac:
+            disable: true
+#------------------------------------------------------------------------
+          extauth:
+            configRef:
+              name: oauth
               namespace: gloo-system
+        routeAction:
+            multi:
+                destinations:
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-productpage-9080
+                          namespace: gloo-system
+                - weight: 5
+                  destination:
+                      upstream:
+                          name: bookinfo-beta-productpage-9080
+                          namespace: gloo-system
 EOF
 ```
 
 Let's take a look at what the application returns:
 
 ```
-/opt/google/chrome/chrome $(glooctl proxy url --port https)/get 
+/opt/google/chrome/chrome $(glooctl proxy url --port https)/productpage 
 ```
 
 If you login using `user1/password` credentials, you will be able to access since the user's email ends with `@solo.io`
@@ -2023,13 +2328,13 @@ If you login using `user1/password` credentials, you will be able to access sinc
 Let's try again in incognito window using the second user's credentials:
 
 ```
-/opt/google/chrome/chrome --incognito $(glooctl proxy url --port https)/get 
+/opt/google/chrome/chrome --incognito $(glooctl proxy url --port https)/productpage 
 ```
 
-If you open the browser in incognito and login using `user2/password` credentials, you will not be able to access since the user's email ends with `@example.com`:
+If you open the browser in incognito and login using `user2`  /  `password` credentials, you will not be able to access since the user's email ends with `@example.com`:
 
 
-## Lab 5: Observability
+## Lab 7: Observability
 
 ### Metrics
 

From 5c735030917c3c228e35a06c1d6dce779e540ad2 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Thu, 22 Jul 2021 18:43:01 +0200
Subject: [PATCH 09/28] Fix typos

---
 gloo-edge/gloo-edge/README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index ca1937687e..801758d31c 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1473,7 +1473,7 @@ spec:
 EOF
 ```
 
-With the **httbin** application, you can simulate that the server returns a 401 status code. Let's run it and see that calling `/status/401`, the returned body is what you expected
+With the **httpbin** application, you can simulate that the server returns a 401 status code. Let's run it and see that calling `/status/401`, the returned body is what you expected
 
 ```
 curl -v -k $(glooctl proxy url --port https)/not-secured/status/401
@@ -1598,7 +1598,7 @@ spec:
 EOF
 ```
 
-> With the **httbin** application, calling `/get`, you can debug the request headers. since you are transforming it to add a new header, after running:
+> With the **httpbin** application, calling `/get`, you can debug the request headers. since you are transforming it to add a new header, after running:
 
 ```
 curl -k $(glooctl proxy url --port https)/not-secured/get -H "x-my-initial-header: Bearer this_is_my_token_for_test"

From a134fdce179488190ef5d5f90f346382ef4330d2 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 11:15:52 +0200
Subject: [PATCH 10/28] Remove unnecessary RouteTable

---
 gloo-edge/gloo-edge/README.md | 521 +++-------------------------------
 1 file changed, 33 insertions(+), 488 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 801758d31c..2b52a5c0d3 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -460,27 +460,6 @@ Now you can route to multiple Upstreams by updating the Virtual Service as follo
 
 ```bash
 kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: httpbin-routetable
-  namespace: team1
-  labels:
-    application-owner: team1
-spec:
-  routes:
-    - matchers:
-        - prefix: /not-secured
-      options:
-        prefixRewrite: '/'
-      routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-
----
-
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -549,27 +528,6 @@ To setup TLS you have to add the SSL config to the Virtual Service:
 
 ```bash
 kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: httpbin-routetable
-  namespace: team1
-  labels:
-    application-owner: team1
-spec:
-  routes:
-    - matchers:
-        - prefix: /not-secured
-      options:
-        prefixRewrite: '/'
-      routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-
----
-
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -597,18 +555,10 @@ spec:
       - matchers:
           - prefix: /
         routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
 EOF
 ```
 
@@ -739,27 +689,6 @@ Finally you activate the authentication on the Virtual Service by referencing th
 
 ```bash
 kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: httpbin-routetable
-  namespace: team1
-  labels:
-    application-owner: team1
-spec:
-  routes:
-    - matchers:
-        - prefix: /not-secured
-      options:
-        prefixRewrite: '/'
-      routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-
----
-
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -792,19 +721,10 @@ spec:
               namespace: gloo-system
 # ---------------------------------------------------------------------------
         routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
-
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
 EOF
 ```
 
@@ -857,27 +777,6 @@ Now let's update your Virtual Service to use the **bookinfo** application with t
 
 ```bash
 kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: httpbin-routetable
-  namespace: team1
-  labels:
-    application-owner: team1
-spec:
-  routes:
-    - matchers:
-        - prefix: /not-secured
-      options:
-        prefixRewrite: '/'
-      routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-
----
-
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -914,18 +813,10 @@ spec:
               namespace: gloo-system
 #------------------------------------------------------
         routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
 EOF
 ```
 
@@ -952,27 +843,6 @@ And now, let's update your Virtual Service to add the Rate Limit Configuration d
 
 ```bash
 kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: httpbin-routetable
-  namespace: team1
-  labels:
-    application-owner: team1
-spec:
-  routes:
-    - matchers:
-        - prefix: /not-secured
-      options:
-        prefixRewrite: '/'
-      routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-
----
-
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -1013,18 +883,10 @@ spec:
               name: oauth
               namespace: gloo-system
         routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
 EOF
 ```
 
@@ -1054,27 +916,6 @@ Let's update the Virtual Service to restrict requests with huge payloads to avoi
 
 ```bash
 kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: httpbin-routetable
-  namespace: team1
-  labels:
-    application-owner: team1
-spec:
-  routes:
-    - matchers:
-        - prefix: /not-secured
-      options:
-        prefixRewrite: '/'
-      routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-
----
-
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -1122,18 +963,10 @@ spec:
               name: oauth
               namespace: gloo-system
         routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
 EOF
 ```
 
@@ -1160,27 +993,6 @@ In this step, you will block `scammer`:
 
 ```bash
 kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: httpbin-routetable
-  namespace: team1
-  labels:
-    application-owner: team1
-spec:
-  routes:
-    - matchers:
-        - prefix: /not-secured
-      options:
-        prefixRewrite: '/'
-      routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-
----
-
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -1227,18 +1039,10 @@ spec:
               name: oauth
               namespace: gloo-system
         routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
 EOF
 ```
 
@@ -1294,65 +1098,6 @@ spec:
             upstream:
               name: team1-httpbin-8000
               namespace: gloo-system
-
----
-
-apiVersion: gateway.solo.io/v1
-kind: VirtualService
-metadata:
-  name: demo
-  namespace: gloo-system
-spec:
-  sslConfig:
-    secretRef:
-      name: upstream-tls
-      namespace: gloo-system  
-  virtualHost:
-    domains:
-      - '*'
-    options:
-      ratelimitBasic:
-        anonymousLimits:
-          requestsPerUnit: 5
-          unit: MINUTE
-        authorizedLimits:
-          requestsPerUnit: 20
-          unit: MINUTE
-      waf:
-        customInterventionMessage: "Blocked Scammer"
-        ruleSets:
-        - ruleStr: |
-            SecRuleEngine On
-            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
-    routes:
-      - matchers:
-          - prefix: /not-secured
-        delegateAction:
-          selector:
-            namespaces:
-              - team1
-            labels:
-              application-owner: team1
-      - matchers:
-          - prefix: /
-        options:
-          extauth:
-            configRef:
-              name: oauth
-              namespace: gloo-system
-        routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
 EOF
 ```
 
@@ -1411,65 +1156,6 @@ spec:
             upstream:
               name: team1-httpbin-8000
               namespace: gloo-system
-
----
-
-apiVersion: gateway.solo.io/v1
-kind: VirtualService
-metadata:
-  name: demo
-  namespace: gloo-system
-spec:
-  sslConfig:
-    secretRef:
-      name: upstream-tls
-      namespace: gloo-system  
-  virtualHost:
-    domains:
-      - '*'
-    options:
-      ratelimitBasic:
-        anonymousLimits:
-          requestsPerUnit: 5
-          unit: MINUTE
-        authorizedLimits:
-          requestsPerUnit: 20
-          unit: MINUTE
-      waf:
-        customInterventionMessage: "Blocked Scammer"
-        ruleSets:
-        - ruleStr: |
-            SecRuleEngine On
-            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
-    routes:
-      - matchers:
-          - prefix: /not-secured
-        delegateAction:
-          selector:
-            namespaces:
-              - team1
-            labels:
-              application-owner: team1
-      - matchers:
-          - prefix: /
-        options:
-          extauth:
-            configRef:
-              name: oauth
-              namespace: gloo-system
-        routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
 EOF
 ```
 
@@ -1536,65 +1222,6 @@ spec:
             upstream:
               name: team1-httpbin-8000
               namespace: gloo-system
-
----
-
-apiVersion: gateway.solo.io/v1
-kind: VirtualService
-metadata:
-  name: demo
-  namespace: gloo-system
-spec:
-  sslConfig:
-    secretRef:
-      name: upstream-tls
-      namespace: gloo-system  
-  virtualHost:
-    domains:
-      - '*'
-    options:
-      ratelimitBasic:
-        anonymousLimits:
-          requestsPerUnit: 5
-          unit: MINUTE
-        authorizedLimits:
-          requestsPerUnit: 20
-          unit: MINUTE
-      waf:
-        customInterventionMessage: "Blocked Scammer"
-        ruleSets:
-        - ruleStr: |
-            SecRuleEngine On
-            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
-    routes:
-      - matchers:
-          - prefix: /not-secured
-        delegateAction:
-          selector:
-            namespaces:
-              - team1
-            labels:
-              application-owner: team1
-      - matchers:
-          - prefix: /
-        options:
-          extauth:
-            configRef:
-              name: oauth
-              namespace: gloo-system
-        routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
 EOF
 ```
 
@@ -1628,6 +1255,8 @@ For the purpose of the demo, you will apply this transformation in the general l
 
 > Notice that the previous transformations have been commented out. The reason is that transformations in lower levels like at Route Table are prioritized to the more general ones like the one in the Virtual Service.
 
+First, let's remove current transformations at the Route Table resource.
+
 ```bash
 kubectl apply -f - <<EOF
 apiVersion: gateway.solo.io/v1
@@ -1643,41 +1272,20 @@ spec:
         - prefix: /not-secured
       options:
         prefixRewrite: '/'
-# ------------- Commenting transformations ------------------
-        # stagedTransformations:
-        #   early:
-        #     responseTransforms:
-        #     - responseTransformation:
-        #         transformationTemplate:
-        #           parseBodyBehavior: DontParse
-        #           headers:
-        #             Content-type: 
-        #               text: "application/json"
-        #           body:
-        #               text: |
-        #                     {% if header(":status") == "401" %} 
-        #                     Hold the horses! You are not authenticated
-        #                     {% else %}{{ body() }}{% endif %}
-        #     requestTransforms:       
-        #     - requestTransformation:
-        #         transformationTemplate:
-        #           extractors:
-        #             apiKey:
-        #               header: 'x-my-initial-header'
-        #               regex: '^Bearer (.*)$'
-        #               subgroup: 1
-        #           headers:
-        #             x-my-final-header:
-        #               text: '{{ apiKey }}'
-#------------------------------------------------------------- 
+# ------------- No transformation applied ------------------
       routeAction:
           single:
             upstream:
               name: team1-httpbin-8000
               namespace: gloo-system
+EOF
+```
 
----
 
+Now, let's apply this transformation globally to the Virtual Service:
+
+```bash
+kubectl apply -f - <<EOF
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -1813,27 +1421,6 @@ Now, you can update the resources to validate the token, extract claims from the
 
 ```bash
 kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: httpbin-routetable
-  namespace: team1
-  labels:
-    application-owner: team1
-spec:
-  routes:
-    - matchers:
-        - prefix: /not-secured
-      options:
-        prefixRewrite: '/'
-      routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-
----
-
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -1975,27 +1562,6 @@ Thus, the RBAC policies will be applied to the **httpbin** application.
 
 ```bash
 kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: httpbin-routetable
-  namespace: team1
-  labels:
-    application-owner: team1
-spec:
-  routes:
-    - matchers:
-        - prefix: /not-secured
-      options:
-        prefixRewrite: '/'
-      routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-
----
-
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:
@@ -2194,27 +1760,6 @@ Finally, let's update the resources. You will disable RBAC to not interfere with
 
 ```bash
 kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: httpbin-routetable
-  namespace: team1
-  labels:
-    application-owner: team1
-spec:
-  routes:
-    - matchers:
-        - prefix: /not-secured
-      options:
-        prefixRewrite: '/'
-      routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-
----
-
 apiVersion: gateway.solo.io/v1
 kind: VirtualService
 metadata:

From ff63561bee08fd01f85b0f5469f21aab947338b6 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 11:19:48 +0200
Subject: [PATCH 11/28] Move note block below.
 https://github.com/solo-io/workshops/pull/69\#discussion_r675391779

---
 gloo-edge/gloo-edge/README.md | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 2b52a5c0d3..d359591e0e 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -616,12 +616,6 @@ Then, you need to configure it and create two users:
 - User2 credentials: `user2/password`
   Email: user2@example.com
 
-> **Note:** One of the following commands retrieves a token which expires quite soon. If you get a *Not Authorized* error, please, re-run this command:
-
-```
-KEYCLOAK_TOKEN=$(curl -d "client_id=admin-cli" -d "username=admin" -d "password=admin" -d "grant_type=password" "$KEYCLOAK_URL/realms/master/protocol/openid-connect/token" | jq -r .access_token)
-```
-
 Let's create the users:
 
 ```bash
@@ -648,6 +642,15 @@ curl -H "Authorization: Bearer ${KEYCLOAK_TOKEN}" -X POST -H "Content-Type: appl
 curl -H "Authorization: Bearer ${KEYCLOAK_TOKEN}" -X POST -H "Content-Type: application/json" -d '{"username": "user2", "email": "user2@example.com", "enabled": true, "attributes": {"group": "users"}, "credentials": [{"type": "password", "value": "password", "temporary": false}]}' $KEYCLOAK_URL/admin/realms/master/users
 ```
 
+> **Note:** If you get a *Not Authorized* error, please, re-run this command and continue from the command started to fail:
+
+```
+KEYCLOAK_TOKEN=$(curl -d "client_id=admin-cli" -d "username=admin" -d "password=admin" -d "grant_type=password" "$KEYCLOAK_URL/realms/master/protocol/openid-connect/token" | jq -r .access_token)
+```
+
+
+
+
 The architecture looks like this now:
 
 ![Bookinfo with OIDC](images/bookinfo-oidc.png)

From e12a1e284e72ee27b27084d0df0409b1b279be81 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 11:21:06 +0200
Subject: [PATCH 12/28] Remove smecolons.
 https://github.com/solo-io/workshops/pull/69\#discussion_r675392906

---
 gloo-edge/gloo-edge/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index d359591e0e..01d180c01f 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -743,7 +743,7 @@ On the other hand, if you refresh the web browser for the **bookinfo** applicati
 /opt/google/chrome/chrome $APP_URL/productpage 
 ```
 
-If you use username: `user1`; and password: `password`; Gloo should redirect you back to the **bookinfo** application.
+If you use username: `user1` and password: `password` Gloo should redirect you back to the **bookinfo** application.
 
 ![Keycloak Authentication Dialog](images/3.png)
 

From f768f39e322bc5e56fda1e0135e136c184830833 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 11:24:15 +0200
Subject: [PATCH 13/28] Add accurate explanation of the task.
 https://github.com/solo-io/workshops/pull/69\#discussion_r675394762

---
 gloo-edge/gloo-edge/README.md | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 01d180c01f..0b95d054da 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -832,9 +832,9 @@ To test rate limiting, refresh the browser until you see a 429 message.
 ```
 
 
-### Rate Limiting For Authenticated Users
+### Different Rate Limiting For Authenticated And Anonymous Users
 
-Now, let's change the Rate Limit to be only applied for Authenticated Users. But this time, you will apply the changes directly in the Virtual Service. This will affect all routes.
+Following example of Rate Limit shows how you can specify different rate limiting for Authenticated users and for Anonymous users.
 
 First, let's delete the Rate Limit Configuration you have created before:
 

From 190eefe20b57db8ba23bac33d017f020d74710f2 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 11:51:07 +0200
Subject: [PATCH 14/28] Remove public httpbin

---
 gloo-edge/gloo-edge/README.md          | 207 -------------------------
 gloo-edge/gloo-edge/images/httpbin.png | Bin 96042 -> 0 bytes
 2 files changed, 207 deletions(-)
 delete mode 100644 gloo-edge/gloo-edge/images/httpbin.png

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 0b95d054da..31dbc9a52c 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -171,8 +171,6 @@ spec:
 EOF
 ```
 
-![Gloo Edge with Httpbin](images/httpbin.png)
-
 To verify that the Upstream was created properly, run the following command: 
 
 ```bash
@@ -1247,163 +1245,6 @@ You can see the new `X-My-Final-Header` header only with the token:
 }
 ```
 
-
-### Obtain a token from the cookie
-
-In the scenarios when you expose a website, like **bookinfo**, to secure the token (i.e. JWT token in OIDC), you wrap the token within the cookie.
-
-In this step, you will obtain a token from the cookie.
-
-For the purpose of the demo, you will apply this transformation in the general location. That means that the transformation will be applied for all the routes. In your case, the applications you have deployed.
-
-> Notice that the previous transformations have been commented out. The reason is that transformations in lower levels like at Route Table are prioritized to the more general ones like the one in the Virtual Service.
-
-First, let's remove current transformations at the Route Table resource.
-
-```bash
-kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: RouteTable
-metadata:
-  name: httpbin-routetable
-  namespace: team1
-  labels:
-    application-owner: team1
-spec:
-  routes:
-    - matchers:
-        - prefix: /not-secured
-      options:
-        prefixRewrite: '/'
-# ------------- No transformation applied ------------------
-      routeAction:
-          single:
-            upstream:
-              name: team1-httpbin-8000
-              namespace: gloo-system
-EOF
-```
-
-
-Now, let's apply this transformation globally to the Virtual Service:
-
-```bash
-kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: VirtualService
-metadata:
-  name: demo
-  namespace: gloo-system
-spec:
-  sslConfig:
-    secretRef:
-      name: upstream-tls
-      namespace: gloo-system  
-  virtualHost:
-    domains:
-      - '*'
-    options:
-      ratelimitBasic:
-        anonymousLimits:
-          requestsPerUnit: 5
-          unit: MINUTE
-        authorizedLimits:
-          requestsPerUnit: 20
-          unit: MINUTE
-      waf:
-        customInterventionMessage: "Blocked Scammer"
-        ruleSets:
-        - ruleStr: |
-            SecRuleEngine On
-            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
-# ------------- Transformation to Extract Token ------------------
-      stagedTransformations:
-        early:
-          requestTransforms:
-            - requestTransformation:
-                transformationTemplate:
-                  extractors:
-                    token:
-                      header: 'cookie'
-                      regex: 'id_token=(.*); .*'
-                      subgroup: 1
-                  headers:
-                    jwt:
-                      text: '{{ token }}'
-#--------------------------------------------- 
-#-------------- Remove Cookie Header ------------------ 
-      headerManipulation:
-        requestHeadersToRemove:
-        - "cookie"
-#--------------------------------------------- 
-    routes:
-      - matchers:
-          - prefix: /not-secured
-        delegateAction:
-          selector:
-            namespaces:
-              - team1
-            labels:
-              application-owner: team1
-      - matchers:
-          - prefix: /
-        options:
-          extauth:
-            configRef:
-              name: oauth
-              namespace: gloo-system
-        routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
-EOF
-```
-
-This transformation is using a regular expression to extract the JWT token from the `cookie` header, creates a new `jwt` header that contains the token and removes the `cookie` header.
-
-As explained in previous Labs, Keycloak will return a JWT token, so you’ll use Gloo to extract some claims from this token and to create new headers corresponding to these claims.
-
-To test this, first you will need to obtain a valid token through your **bookinfo** application:
-
-```
-/opt/google/chrome/chrome $(glooctl proxy url)/productpage
-```
-
-After refreshing, and maybe signing in, you will access the application again, which means that you will have the valid token in a cookie.
-
-Now, let's verify the transformation using the debugging **httpbin** application. This time, in the browser:
-
-
-```
-/opt/google/chrome/chrome $(glooctl proxy url)/not-secured/get
-```
-
-As you can see, the browser has sent the cookie as a header in the HTTP request. And after transformation, your debugging application shows you that there is a new header with the token. Something like this:
-
-```
-{
-"args": {},
-"headers": {
-[...]
-"X-Envoy-Original-Path": "/not-secured/get",
-"Jwt": "eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJMN3duMjIwNEVGbUVOanpTRkxzUl85SWVvT3BHQTdCYl9rbTZqRGo1OHVZIn0.eyJleHAiOjE2MjY5NTkxMDUsImlhdCI6MTYyNjk1OTA0NSwiYXV0aF90aW1lIjoxNjI2OTU3NjU5LCJqdGkiOiI4M2Y3MDM5MS1mNWUzLTRmM2QtYjEzNi05YzZiZjZmYjYxODUiLCJpc3MiOiJodHRwOi8vMzQuMTQxLjk5LjYyOjgwODAvYXV0aC9yZWFsbXMvbWFzdGVyIiwiYXVkIjoiYjdkN2VjNWEtNDQ0Mi00OTM5LTg4NDMtMGJkYjlhNWM1MTQyIiwic3ViIjoiOThlMTM3ZWYtNTM2YS00NTkwLWE2NDctNDU1MmZiMmU3OThhIiwidHlwIjoiSUQiLCJhenAiOiJiN2Q3ZWM1YS00NDQyLTQ5MzktODg0My0wYmRiOWE1YzUxNDIiLCJzZXNzaW9uX3N0YXRlIjoiODRlMDQzMjgtNjAyZC00MmRkLWJiMmMtOGFkYWUzODk5ZThlIiwiYXRfaGFzaCI6IlpiWGdIMGZjdlVfTWJibC16ZmFOTVEiLCJhY3IiOiIwIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJ1c2VyMSIsImVtYWlsIjoidXNlcjFAc29sby5pbyIsImdyb3VwIjoidXNlcnMifQ.auGfDKVg7ULeAVj5HVVNhoW-o-0jh3dzS4_ZOZC_YiP7tD5ku4ul9Ay8Qv9tERNKRyXSOegR43uAxE9fRXagqgbFplgUwQmF0bOUr-0tPukDT94_Qxf4OlL4znTEYWXWnSLPosTpSqvRZOrDq87OZv_KFcEVu97Bj04quMQVhOQMw1znv_jctKKZfBE32hDY7NkgJPWHRJ7etNPYrZmFVk2PYmycI_nwCFerm6zs7jEsiweLbnvUjVe8nNbjngoGsZyzfz3dV5nBWJ0ibkNY_Sea-hK691p_MCZn7IR5mCxkuXA93Vcw4olkAV45bACfRebBP9eUY_rojkBgYC843A"
-},
-[...]
-}
-```
-
-Also notice that there is no `cookie` header sent to the back-end anymore.
-
-
 ### Extract information from the JWT token
 
 The JWT token contains a number of claims that you can use to drive RBAC decisions and potentially to provide other input to your upstream systems.
@@ -1451,22 +1292,6 @@ spec:
         - ruleStr: |
             SecRuleEngine On
             SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
-      stagedTransformations:
-        early:
-          requestTransforms:
-            - requestTransformation:
-                transformationTemplate:
-                  extractors:
-                    token:
-                      header: 'cookie'
-                      regex: 'id_token=(.*); .*'
-                      subgroup: 1
-                  headers:
-                    jwt:
-                      text: '{{ token }}'
-      headerManipulation:
-        requestHeadersToRemove:
-        - "cookie"
 #--------------Extract claims-----------------
       jwt:
         providers:
@@ -1592,22 +1417,6 @@ spec:
         - ruleStr: |
             SecRuleEngine On
             SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
-      stagedTransformations:
-        early:
-          requestTransforms:
-            - requestTransformation:
-                transformationTemplate:
-                  extractors:
-                    token:
-                      header: 'cookie'
-                      regex: 'id_token=(.*); .*'
-                      subgroup: 1
-                  headers:
-                    jwt:
-                      text: '{{ token }}'
-      headerManipulation:
-        requestHeadersToRemove:
-        - "cookie"
       jwt:
         providers:
           keycloak:
@@ -1790,22 +1599,6 @@ spec:
         - ruleStr: |
             SecRuleEngine On
             SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
-      stagedTransformations:
-        early:
-          requestTransforms:
-            - requestTransformation:
-                transformationTemplate:
-                  extractors:
-                    token:
-                      header: 'cookie'
-                      regex: 'id_token=(.*); .*'
-                      subgroup: 1
-                  headers:
-                    jwt:
-                      text: '{{ token }}'
-      headerManipulation:
-        requestHeadersToRemove:
-        - "cookie"
       jwt:
         providers:
           keycloak:
diff --git a/gloo-edge/gloo-edge/images/httpbin.png b/gloo-edge/gloo-edge/images/httpbin.png
deleted file mode 100644
index 8d7b59625c3db26a66856a1cf6a520cb8fcc6838..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 96042
zcmeFZ`9IX}|1T~jNvKqcEG-Bj>&PyZB1`sNvageU7-OPEWvh^7EXls_gc(GUJ=<7@
z8B2C!#yS`?&eQ9CKIgp8=gs$g|A6z0o7>!YJ|A;kkL!BeANTwHy58$(sWF{qKTShJ
z!}R#keO($FIsy&NasE>$flso%a~o)AcxWEqSJ8)9E|1fDUohBjS*8E{ktU7A$C>fr
zrGDlI9?cKlCq898I`{G0MiI{g*+;A=RCE%F*S}pCq@@+4RVP?vyg7erQo--VkgG3f
zMAG=TU-wRG!!owUYfhrvzsG;Jo51%SM&42=z4nrZ_7u-yKhB2HPPar14wu^4l(udU
z8qhY8w|#!xH9K)undaDk{+Li<I6I+cl}J?F^<92{<U`-n91GfTKi5Q_uPJ3a;>|B#
zhSHwc=DPRB=^=#MM`G*H_Z`IW?i=v5fyPsW^w|e4{~6N1!VGpieRcxMtOg;}TogWc
z)U%%7QhrIe!ZV3-(5kq1*!TPAeZ0qL_kLevAlv|bqdO{i<=c$FK%7yBaCd;NjvqO`
z5I*3A*!M(iIrN?3;WGftiU$wySM0GwMP_&D+WSYvMKpg&gB$rk#IBP=za0Ino5Y+G
z+nE}1edt2W)T7A;cLu_AQvC5lXa680AlE1G$AXG2Q5)?-#g0Eh=-4If!}+r>;H6)a
zdb4cQjvVpfOGGpc9E<eNGb#T<@y<8M&%?oS7ctpjLKIQ4+i~IYAqn))m*bJ8#a^1I
zcEcE^KSa&F5R|ZgGW7D;@o!!MTzFLo;T&tk;n@fLGgn4qGcz%oU%Tk^MZx)zIl;wB
z>0;UBT|&ctk@H|ml*IWavP^oW&5=>ZpOP=2!F5&;#%jXKY}?LH5<B8Vvyam=|NMJl
zd_@Do&0paC;mE}1pk)zn?D=@@6`yuW!H0`N{*oJA2zVa??Aw>Cm#yH;9sBS#>1ppb
z;iK}V@i-eq=NL8Vu9rcbFaB1tm5$EG(F&(RLIdtXCgr-z69{+0S=^1omg>Q0^4`JU
znTgQN#Y{_7fErmI=bv3{-;=_Lr!*5DLAYIFyk8#~dmOFD#R;YTKm%dZ3YivF!oY%$
zu-TS>I9ZJIEVlLZjpQR!ME+Fp_fy27LbL3tUm8E#i9$w2UlpL#a1X23Br(2><3|oQ
zy}((-v7jo~kqVpEZetEAke2#Yu2(4QJxXGW(L}|Efy?1X#Y?<%;v2^VVsy)>*m5xZ
zibR2RoT!ynM_h6Epx$ta^{bOi>^Z=+-LJE1B0Kh%-Z*l^n=ic6dWoxW(qrO~Hs@8p
zP<?Oj`zeAOU&B7NuF7@Cq~nY5AfbWq;rzu(Sj>0FBLkYyq<zXn)PyK`Ox+wT-v1o5
z>r@^HgZV5Ed+hA&{915|xFTU{(-OYAefc$sORx9rQR&~vLHF(a1PiyKIj5|5MJQ=D
zknc(S*V!(!p9{Ik3ebmmOm#o7c;#i8CsAroB#+#vi1x>{kMAYR`3bt9UE8Dis|}=E
zU76S=|7<LfTqarvTRO?#KWADUH9N<OFTK0nC~E%wV?D(;-G_OhKif+tj#uMLj^~V^
zhi8z>P*HDwaXouxeS$wXuL%2*NeL-ezJDxem{_kKt3HZ?Mp5)Xu)$52(1lT(deFJ#
z`a}h&Zw#3i86|#2?#LYb=ONS|uR>$w{XOwml-cGY%2qU4uh>#yrVC+&3fPRS)I&)4
zrR;7kTr8vl)!<i)){(m)_V$EGBVjN<PT?!)7<HdoZ77P=vCvl7)GtWwb}6pxjk5~6
zQW(VWe|d@s@RU?Zr_YI!PVCvuN<ND*f`$dpQb)K4U!B9M8H8^g89-EcWAkZZy4e!;
zqy}XF_t^6@7mi8?U^kpRzE|tB<cu!J5xu^&P};B`l+G^Y{MX4V4u6VZ^Ru=4==X#)
z8d<?IqZAW!*Je8M{RoO&EdHJGy-!Vl`T~i)*q2!z$tgFxDrPQq6B%`mTkgnNlozB8
z3JQA4<xJTXU1*OLS{$z{b{@z%H%ZMmDmEmojC*e`R^H;~-(&v2EPAyEJl0LG*H%|o
z9ltm1m1#zBfciF<Km}V_7qlYSMNO{-4bvZ!^IQ2-U{YS;IwBsmyP0ur62-4xp>kB|
zgSeiMXCM|^HMrA}8ur%0`u)i}J30EfedxK?sMJ62S^1xjza=W7A1@re=rDBG8Ht!m
z7obiVDpd6IAmNT1SC1@F6V|7{GZMLdUx1&SB5=<p|0q2YRB+`fZ`0s7LZD6L&;X4W
zFOFPq;Ik!k+t~ACtXOEX#gEHJ*SOk7U{UMWc+zp+^;}MidPBqti5z=%6sS2%JQ?gU
z-Qv7FT#CJO!5ItvW$^6mkqKjYZ9@2%A|pEB7rv3_$PkbZ8aZeKo1owtj?45%?W`|{
zPRTFRq!O_%?sO+Zj@rk8ZIeZ!ksnFQk_#?9dilp5tQQ6XYEk;xog;(C@)7U+6ILDL
zWtOAEVvwId2y4mx*vTWy;Y7qiDF?!8k$Wk2G=9r$eDzOQYikm>j-J?ykh8}WCsEaw
zu$DJRjzcA_2j>JZ_xMbQXQ$)?gDLb;&V+hZS&y}(B1=YHM@Pr-ld*TK@9}D1%5gQ3
z$azK`Ymehs3*WVIIP}e2S<2=ow_lT3*4sT@PayRtI!73Hck5DpmVYkDa9VG<CKwcY
zn%K3+i)clu&K)|YKVy~6>3~Og`23n@3s%!_?5wh?eGUtE7=Z@t+Diwe2Z-Kb#Od7`
zJ#2s=$;##@wxcW{N}d}RERfq#&A&8K6$^Ja0-Kjaa;neFw-36o%RUe3f6*QXeaK{)
zcW&BxMd^jHSrsJ@1z$1xLA#^Bn~)u=WL0#Tq(NUQ`pkZ;XUBHuIOB?&!!z2wAyc%&
z$)IH`-GIX&F+`cRlygGKcM>*zDcO6H5XKyL!z=5IsSJ4Pc<ucttaW#iLh)>2oeUFF
z3-7$xn`sfQHNW>J%(<^DT8~>pF(Gebq3>r7*f$auypvk=VO{s`%0oBx`3h%4(3bWG
zu0xmm!Aq|IbExz+Y_==(eFrgUfz3tIrzJ4EpYW&XO`_EGoXsq9Q%r}++OOJB*$h4=
zXC1}4G|OYmk%y$kS-s%lgXBv0=haG*FU&W3wG5r>K<EM6FxTd#t5*wNg+`8GvYsTE
zn}|DXIO4uLUWl8dWNR2X%@(}TYIg6>D>bcjyv&xZn%aB8xOA3-QabmtAFIf~nrD)3
zDlRci7-Q%i!nvV~>!{w2Mkr_hiz4ybK|%GqP90j5693R<QXyhUFYAoc%+gYR!xlHX
zEOyBvvg}bBGS4XAS+eKl_@NsFkvVwy)Ir=H!m6sOgI^bxYCUH@zz7L?SR<_bUHL_~
z@!g03__8DvGuIy1_a|6EVH707{>u&m=JKp?#*8}+GtLI)6qs;fkB5DK5ja3jlC=3G
zVpX%~&EE4xpolH+%g}h8-^}#1&0sUPyz>W?#g6zdyC(9-I=|REDzpi^n>Q5W(<UY`
zThilL$gk5Y$D{eGcH_xyo}71m`xcA^^llo(MRsxfsJBENGVU*5K4%9eQEi%Uce8qY
zvDYEKIprw>p>E@H&Ny`IR~QkS^p{1+t)E4S@=XCs%60rio40K)5G!DCoqcWjd>k$C
z_65(hQEA~Np;lHCsi{{Bc^l>e33uQvNxx)$W<#WsE=9Nq!LdnbhsU39_6lh(Iqxho
zX_c>QVsv@Ka(p+{cW24MyVO>zB(2sH`xNZT*|_Y-xI>qy{GH(V6TlMf{r<!rjZ9GB
z_Fb1mD*5adm{u*!mJp`p*A>~3%WEG`yp2d%S^EuxR>TP;+t~NdbwsNQBL+&_r{dS{
z+6!&ix=T43>w(<I2Jmv%)Dx~JZ0-5$Xw+|~s>1CJsb=6R!w-MkB&`<%Eo%302q9|@
z=6TAl>iLP1L!<gxuk3w%4{{DW_dCVF%OSEd--_{cU+{4?pRF<fOzk*BAY*lQH=GJR
zxjwn6sHo)imlW!iuiBgx&=zSeyZiq9PTQW<up2g{XJeH=RW8tQH{tmrZb<A8h>7-i
zv`mFW<r>hSx$NIg)28KpoHU#kApk7{<E$-e15IkYW^}r*j{IHXSoN<FLg+QPGx@;E
zBT)Mi4&4iXK26v95mG$o+KZlC=@(K7IdSfDg02t<d{V9wn2Sci;`6><gVIiYKbc$a
z@R|YZE?qS=%B1|K<^pHArE-~V@F$Df%Wyb(i!&iqH0y%SpG^++Xu;UNOpQWdQ}#z<
zRdoI^g?gMgu`Oqw`tf7kD14%%JGtSj+_h_`iKL<OnG}yQ@#M?Ja1jgi&N`dV${r4Y
zc3);b3O+b(*BOHy9U7b^5av9QEB06f5j)nZibLdOhh5U4$o9y+Ce2>%i4{s~qFZkt
zYE@h4%R*xtn4MSW_TP~Bz7q!O6Z*0>Zs?i8=fF^l$cO}zSiR=LVW6pzk?tGoL~9ta
z{zckeqNIC{lvz;k=Zl8h96=J-wwLf`dFU_$^OKoblr7FW$)LX5$%<ax=^a*+BYo`R
zUqc7c@^|7v@Z5Uin(lO%X8K5f>n)>h{$)Hz^?U{++{$|x-nHhh{`qDpwK^zW(PZOI
zM`^66nJx;7Ec)9PT_ayrN33^BuXP^E%C+w_&Dq55&Ff6#ylp!d8}u!TE8VBiuFcg-
z&Ogb~Ns)5IarZp)(xm3OqS3_A>%Tr+s-RteuQ%&V?zRx=NgLLCGm!2gXV;N9Vq>Mv
zp7=6wC$G3-v13z&z=2Rj)eahDqu1NxuO(yLHF<CwvE9r#zlDK=dSeZ%q9QaCr5sB8
zrLZNwpPFCsuAg-nOk_e+yr*Y1wY8elG`B;=t3<~Kkzicyr!u>)oI*LOPW{+Ote~A|
zm)Upoi>boA@csLy8zXUo`aIR{W8X79GgA$-!WSx>@qU83w^BDL8zW(ZnKq0<14@wX
z@64Qc)28{g7JdrM;m%1B(gW{~96JQ~Pn<jV&iN&`XcJVT9JSs5K+<hC<dJAP!)|Lm
zsL{Fw$)JHFKg*MLA3eW7wdRQb6SzHLIa-ScF>&6#)~@2Rtt(&DM7Dl~t+Icmy+0p)
zs`blVy^|4KJ4I3&3VX96NO-3IaZb4)bwtn@yEQIrS-U|od4}*ji!_AW`}!%JUk<M{
zk?fwQ+a`we8>}*!j?*vlX4qU%YQLdm#6tJYySGVFn&nKV4~{%{EUNC#P;+ODUuBJF
zRqPYfx)rmCD@x5yp!JuwT_60ndb&91708h<0zOWy((n%ET4*ZNR(Os6>U_6v6SZEG
z^*C8qlLM{)cEhP)gxY`~&5m_x_>}Moj9uLJ949&J%=zall{@0GN-WMJ?VDSK(5RH6
zYXo0k$gAhL;2WmfBXL?bw{&k6FAnCh$M&Zk&a6a*E9=u9>_=*w?UnGtghWuT0}lVM
za<8Xf_enUO6Xf*85WeFRLn7Tof+mZy%ZoKJys1xo1Y4&?kWuX~J7NXW&Z!2-;m`LI
z6$R%UnB7N3E$`fIvGb;m`sskZ@oX1qp_mk~j}D$K`M9G|w>=USfGoOpqoq#%i$I$M
zeCxzgosdy+E`<Y@WIwCs^Kqq#e1P%V*j8|79)Ffm27&3!?4p~%S%IH(ec%gggE`Et
zX|U*%QU$fUu7_^3@<p^M2N2JF<)vL%mXKzmKDruv75I`TR|ZOB*`;!3O3Ykeld@Ee
z!nRr@kx`2~30o2DXv1vg;`<IpF5G$=`(5so%^|94@5=PF$@J!Z>DKd#y&fW_+mB%~
zzVD<W?{bUwhCHy6i4Xv%B#HAz((bW3O|zJ7Zh{czk#+9LZ2Eh-_X6@9RT9=Di>d&i
z)K|)yoesl_jfg?3I-Lg#+@I7wJDg(RVmPJ^%n2KIsF?IEr87>$-dab318boy=jq5D
zD{L`V`{&xVYr7unzT<Ul&Vyg}?Z^ZzkTSwBqVSDIv-_34Y`q_}{yq~EPm|?+M)Me`
zKTgc`-Lh91Hxy=<-888k=x1i^s})4pU<52iB?D?yGy&x7sNiZ`=3UuwWk*0a<4@TG
zJpkIcC|TO3mF4nV)jT&zc%bHo$IeM#Ei&A^i^5<^v!JeTN!qg=h3&EJCShl|?*`mk
zXA|+-QSD5YsI%AP=EQU7ns7`~O8d=M!0LBm17@9e_|-FD^elC-^ly;TCU!EFCRFjd
zm#<Hw`o(rforV>(k(=zsK(7ryXJW!qjqQ({p`RZ#KZNCgLGHeb?wfO7$=KRcxOo7s
zC$6`7E*)!mHP(5rvbeGUJlNr&df0Z(qj>86rHR&jBDQKf7vDrrkE^mb=9cyBT(Ep0
zr8+LT>)4%*{#HE+GAi$GuCDQz&T<}v4?0<y`6vH&f8;lbV%X=8<ebtGoF#smUhIQ?
z?Vy3rH>Maq=Ehulnq!VKeXzNR?X~`)??r9-F<2GY_9XL3LKD@%^$jUYF$h;J*Vfb1
zgC#{F;Jq)eaeu$sTD^2hZooLI6TO8JV9=`z;)rvfJ=T$5Ea^G#huOjnWaDndjU&!K
zSm@7O{XK&IeLK+{X?zaoMGUiKBm95I2pXKGqod2!YOd016?38WcEpTLdX<-W7W=8m
zR8okqeh8XoC}&*A3heH?xWsMz5*$K)xM}&-Tr0!q?a9NIN)+ONgF-S8G}}I|Bqulb
zY;s6D4a5s*4UJhq!Dk3vu6`0r3VYHX?dHN(Gv>`>uTgv(m2T(WkQnDQV@#H%m+dbJ
zyA3Zh#f4>QCEOVcz%*9<GK4gE_j+eis>44Of>|p-PCHp0?8Kr`=vp(CJjE;JOs&<^
z(?bN!l#QTi3n!~537UN%9A$oE2T@#&?$~q*`0E<ZAH{7?w^=0ZH|;z)WmoAm_}iLo
zUAm3K0_(HbGI;&R%9GABd&LdpyWJY|@w#^h1>@{mQ2Zc%x5KbEm&P%_e|^n6ra8|P
zv%~848?Ako_agh}>|1IQ7C3{}TZoE#u6~$!IIhwNyjg1{s<3SMKOqw329OE~y-I$w
z#&Jrg{5FR)-?Qm0{;K-*5CT>oM1sb4*b{6vxaA)zQIO+K;i;Vz9RSCLuSNL}tuzc2
z&hcbZuIHsU_+Y?`a*h65un0E6T<spvbsuRaz6j2|rZ?+#oCJWn*tm!PqJ@hSFfdPl
zyXmnV_$#k?V>0HhmRl&xO6HoK#>2LsolUqp!bbppW#<otJeTLdb(VoLlYt8SHDt$2
z0;8yI^s431dCq^CPoso=P0CkFEo^L5&URUH7aLU*K>8V7pY2TWa;7>DJvwgXHwn9+
zR#R6?oa|r%z8xV?G8~`LqM0~Twi4*w4E38EM7hWf78-QT;NG(GYv&ta$UY0r?z~}a
zgYi!(%iJ|y(n}Wut6n%~!2QNzHFt6CJEu<(s|mR3{abF78BjJ=F<HsviiD1yqOK$R
zp{xe+?1?7&?NvUcAKQyMA+@!f*ChKNeHT-^y#0mf=*D%D-|lynR7;&!O2=B{>^<LX
zUmS0)c^$ss&{4%1;P7(&TS)}_z-I=c+rbVG_J%x&;6VHON3N(Je*i-IkshivC|Ya;
z#yVI;PL5Xc48lfgZt4Numy}mK^wV3Cy)-i6BKJtui&f9A#Jb_!1OdH)GLz#%jr)_W
zZXz1I3BQ7}HQBF>T-)Y41fCoSE#H)fX_PEqlg`nNMFl{>&ZWgBVxsD4W!aM`0k}>3
z#P`uBx$Jsne0%7Mrxrf0LrqkVgHp5+E}$~)4AlW9U~{V29F-LiF?yFtH1OHV%C*PI
zqk{wKVe8aMIpn1a8AEan`TY*v4|aN5UyHrk(C-a-ijCqtEbY%KPy9GN{7->L{8H{}
z$}g%?Q$T{|D%=NYcgXynvI>4P<{#LE3Q7qqCDndxf@~r&R?#g?J_}U=T_+<D+n@UV
zvcA;k=7KTLZy=*?$wc9aSPRs)JGee8z$d@1LdJJ5!_p1czfhMKn`*FMZ*kpcOA-m<
zOmLBXF>lPN;M+IdaQPfcYQlqG@-Q|+nI@Q??-@W%k;CE!a%#Ms;?*);BWuiNVUk)S
zslTVZr(LQ3b-Ok3oK~5-cN3Jys%jVsT^x*7w^KyQe>-k>SrqO7a1IT$52YaZKoeP0
z$$jvv^>k7<=-W$5Xlj*7aKLt<W`2wF;5X}xZlGHwjMrsHDVgL&DecJjDP72V{d78R
z>6Tlf{->(UV~0~?kT{x2*zGr@lo;OsDiI6Jx3=`JMQ|(J>62?756LVvMHWaGvfsrk
z+5SA?Hn!nap=wt?O;6Y~dY>I8v*EEmD?C^*G&%#x)@IM#+wmM}fC9mm&xz!i<adko
z2=6tOR6WcJ{3vkaLeLVfIzP`)1iUYkW#{!oZJNIaoj16|$!v!{@f}JkI!}M%mg-yY
z_K%8%m3Q1e-+X@qmF;+h?u8XlhH(D^*p@jf=fzGsEu(S(nGB%H*S}?2b0nJd8#qh)
z`11qnHLovIlXcQ!N(2e=A+$zv@#xu%S5c5Y*;vl)`VJ~z6nEA=y7dR_f{2s$y@RCC
zhIIX0U1K~zV@TQWohdYH=(WS;E2b9O1_y5ukOD|tC0W#MkLp1AzQcA=Fy1Iu=!;&B
zI4=MyreBCy1e_UIQ6MLE7u!d)FZNcV0t2Zo`}meFcIidcxJ&=yIK&?=E-!RKjacCA
zF@i-;n|C2|R%{RdjU_y}9{TRTya4}BR`g!tK}J1?5Q^@9sG%LqQ_MEMoAO5~u6X`W
zTDrLPQpMvNoFZEJRp5o6Z4z2+x6RN`0;<df4#>k-p;1oz!K%(=XFY?!qHt7U9TAIe
zjM){VT$KwlwSt$o&1hPOP-8pn<xZei>|bMK@634R>EF(e5r}qK5^ZoMq|%#jQFQTa
z8-{GH^p~;cv2|vcX8>RbC<+t^UEjg&MzAaRCU$s9vOH2((CbW`sV6jEa~rGpWhbXc
z!VT=R)cx|Fr4%Vq^{cDt<v5FNSHFpeoz2!njHdm3Iz<DwYy13oq|83cTdQLKe%ayD
z9gEsaqT+{1%H)mK!L3b8E(>AS7+?$PNh{3Fc3;ecmZ2zyYJ&l#A5c!VfO-I{HHAo(
z5wX!hnh5RLpq$$Y`v@m@#q}>lYI#q?fFv9EN&E!%#I`kP{q0W-EYxKVT&JMm6Y4u#
z3&4Dnw$BvO$q=Wr0QQ%WF_v1a`hbpaj}vxMIMbeR!>nS<f&Wkr_AI1?77%;^d@-}I
z*?r0lS0mIXG$V-Iw;@?Aj(X{2kP}aqa$*rCJLTC?pHfp(n^$daAd4x_FK!0rr}z8&
zYXFs(GvTw^WOZkPxZ@=9y;f?f99)G{j?^D3WF%i}Xw9*?)c>Hz$RF+05dW5x)hudQ
z)Sr>-l`hYRVP1ELs<xjhKa8E_dHK?h@hn#D22$w-F-I18#Xs4@XcAS!`L+S{7#B#g
z$?$v2KM7lX{w9`B)4AHt)0JNA2W7kWRSch|VAMT3iLG2#HAkR9_nw&ebgFeUM@9Hx
zlTW*ZbfX6|5aNWb@&)>pd}X5mG@b`+Od>smRE;<(+iggK=}wAkmUovN3aej_+!r3^
z@I8ne<c=M93x*GDzb}`+64@bL<7Gdj){iv`Il=I4oL=twp-W$Rj8Pt-c*Bh97B>>S
zm_7Nvrzk-~G`av8I43BYSqoQ#c<k;1S==zujF-gV&jd=OV>;`7FP=e^-F6v*W#>xF
zcAO|Hk}f~H;8Mt8#@I3{ZDi-wNs`D$X3ylKop#!NM3xq+-A8nomWI5IA4xBZiSEIk
zW)Vuv%3DNpRWY;TnWkAm8}I9J6@yNfY8gT}q;qoFtaAQtX;D_lUF@=b{whO1D0OlJ
z>mbhinT7b5EiV90I4N>}VXy6gm7sW)Q<YPx=~pj(lVUs(#VzqCcR+i%dj*TiPYuEr
z4Z28wN1?NrgGR)82Y^D#tNwS}P}R137HYJ)+MN1PU`X=WZ+b0~uQ&Dn?H${^zU(lF
z$KUyl4#mUJ(J7v@P+EYI=Y~qAY}z*AZCbS#fF{`R1>(BDXQq0BIiT@IR2*lWvf7&~
z>rT3R0KN*?7X&`j3##sV0|>`&6lVb8u3y#wNG{I10p@<Hs)Zi5ogXc!)c4mp!}ysx
zzZHi@UDf;i@+TlThjxes^z}5m+Hfr|5ATE?kZ!cvv+w)PY<&I7LxHW9QK@9^H&{l4
zs@n-M*HmRgA3UF)8tYWpGHtcg`hoJ7`=<L#JRs}781yoC07!obJT}nQpS{`O!{Iak
zTP*t;N@<ESR?y_O$XoT)BfhQ%u>49-?C{jC-bBLBPETBBF`U3eAf#MlrZJ4OX<ZwS
zZzNy(#Uv-rx(jmb>s`P{s!(e4b>E1yY~7S$KfF%fe+=wA>gFufVw05SO}MdI>iX(=
zVdITA&67(5MOj=HqYq?mvSNpFFzva(3({khQkQD?SeCBd6*>HYGN;dCmG1eSn55kB
zE`9Eiv(6S&RI{$+HQ#$XQqE)SZ1vJ*^O^unLPSEIFveFl!uDU}n#b+Pk41;WA)YEa
zKo~ZYWF`Y}M%7$&C7`t!K98?&PJS4F{lV$M{B@+~EacvMR{GxselK>~4e-M?8i?xU
z7yb{069<jzj1U2<BjS>W?`d~{F^&2IQ-<uHvM4aVx)^}~4I+I&7B!x{4^fH<qSY<o
zi^YwNH^ml1lMj_ilzCQw@TRdc=t!V$yTnA9tF=a^>Sh;Fk}jogZrtyrtpu1t>#jeC
zce^yl2y8q^64k|)``SN4HuWqgTPt<&8?R7>@3<e=X39;E=P3O-y1{~{4@}B!HypXy
zkJ<uHoy9_1eTa@1%4dV}G~zflvNJTJP2EhTwjAN?3S6{9MRW@jY3b;FAYDJZpQIN`
zJAVt1`PHLkWBW25rw!!l3XoY%W(cYCt1?dAw1;8kV8G-B;qDQU$qxJX`u*<-J3#@4
z6bp~IeC_ZA;d!Yn&kB@#2ezdC2Zs>=2cHpxjx|9E4G+VQ)VO(47yu_vIb-+2;kzji
z9;Bhsh7DW1ZyzmUQTx1Yt}R)WH$`NMV)Ua!ZF^+SD$k>Nl*KjX$B!So&dq#4ha}u&
zV_6^g02qJ0w2&RH;o;{2Ux7_4N2_q|27b2jNBZavhTE_XV8WeyD=ag}e~t*Bi#xbg
z1eq%7Q&j8i%$g}AY5NnBsTHd`6jHRbGG3Rbm!J6IqVVNR#pmU#L=s;v94E3RVpOoJ
z{vhmvPEnG!<KKA!^`x81Y1gjFLRY{Sp?P0TB@4loQa0S6)f=0O)BsmzwaHf2`gItY
zMF=n;v?KUK`#r$8`gAaen!zrrzXo}7P=mrp!Uj-Ym{X*YdYd?DH|)WB_8%iPyF#{q
zdmP}rO6T4?>do)E6*x1G|2e`SfYf?PwCwwMj#V-TXNLa8z`y_yBQ{c=j$qzLA1Bhx
zOG>82j-TSjl2%r00gq5YX#zb<7h<3~#7n!G3?;2RSQxv`NC1IHt^w?_2+s4nukfRe
zFU1A``K3^`A&De?R~2=VvDvyen7e}%cW6JGc@E$<--jLA6Q7d51f-YNB*kKLSwf#x
z@v<x37<6C$tJG5cr{dJqBFmaAK!?+fRi7yc1GlfoD@#A_yJ`3$MG{y==-T%R#<-1X
zL&|smx(sNokC3s2T;<czirgD0k8kI(aLGA614vcH+FZxXQ;3q+)^$7v{>TQ$eRe^{
zm8sKpUpzAf9sEkoduxm?_O_*drDef&)-q93<UM*8&e-DOVuhFkrfsGxTF<J$Jo|=P
zR7YoLHL6XgL|M@wPv;?gnW_QZS{Zt;mpzmE+iIaN({R)IVj+m<NrO#`rcvHN?ge&F
zBLO|Wey<q~A-|$!^v7AzJ#!V6p~8LXR{Wo;8j5+RAHY%!P>+ZDP@5i*jc>@AtSj5J
z^$p7UPQ?Vm&I|JJDC0*ZV;dS8DwnG84FY$ZbltFJ7H})1ZEV>Bx+dZ?-N|<Ouko^8
z!Jlt3|CvnZj}dWWzX%bpUK}d4Rx0qnCFweFpXth<8)a!SFl`98ow)CzW{inXz`nKb
zx3$YUQZ}Co7jYtCDFLW)Awi40cpr}_PNmGwguafR9&Nq}yb>h*?U{Kex(%zM@n>(k
zX4=10j9S)v8UWg5H5GFLZ3QcTY+(s@Q#c_LG*vO%ZS@T(TxtRR_b*`^%=aG%$z#{&
zf(~|d0u#J-u|GP2)IhCQo9niCr+WqAu0Wq_5?w2(m-pJ|sst;pld2u_yJwfwqG=X$
z+e9}`f}r^a70@-L1^jZEI^BaAEY#!J+1{Q97!+XLlL9tlTMQw%a?%|XXo@rQQOc97
zjqdHo<pbGs9L&CHX=&^dL2sMq#-S_*(Qz&{ocVHl0J({-VT9+Kq}Liob2d=Z@N#~+
zHkeCWUVGcone0R@P=4UkVK+4LSDtQZ(&kRhI@`vt4?Y3u%|gs>ofrm{q2i@Cc^9vv
zsFNH3Y)uG1oCtvY1uDxv6G1b1n*#)1_>*R1TDmI)fazC#S&!{3CIG~<IE33Wo?MAc
zhCBZKqloq!3JKYu()Y)Rf<<BlcVeV4V<&p;5kN`j)w=ri$(4PfPi2m6r@NBYEHglw
zwv({7sR!P>ohAV3tVP&Zv{lLiU~&e%UoTJK$W^_Q*^ZO^h3nF0-pynVkh@7a(G3&7
z+FuwzDQchXOx{lbQl=<IKyMgRcbag6BfoAPV3f-Od|kk)PT<i^4oTA+Z#Sw^rvaAC
z7AttFK{J6`nkbp)GR}G+&1N{QCvi!}Q*n!ZhL6wlN3QV#Md2vd9Pu}R??Z(UHbwK=
zO5mYiaFJa1LTA(OkeZe8XrS>f1_aQK*T3ym%*;x_qll56hW%0_1RPs5glYJ8b)?+6
zrQi*qU^M{JrcJ}+CnelL=&F1<$B93s?6M`<6d{Re%<b*OYcN@tAEpvZ<E{K@o0pVH
zMR>f8zs@8jPs&QjDkUjE9L@zT;Y>~-O*TWl6r1Tuo>#Dlwfmck$Y)oErL~*LL>nJc
zm=w#C-OUBp*vV42$!7A;W5>2Y;!RuSP?Dl1qEcB@AEs63yPr9$xj3S+7w-!gJ$sYr
zG}2KeB0&A$_xr+n=yKy}2ev(tCMfF{biSDd&`(y;da~X^bQxA7!*VTB`C<+B6>Q$_
zH~q!S`I<;!Iiw2QVlBj^#?2}n9UE@(nOAppM$M}y5bM>3e9^bP^zyQ`_n)#$RYX-5
z3nM{x(8#L_Y1&F=nSRg)C!e{;ko}?hSG#k47h{FI8csy=n{AIQPaa=Q1_=KhMtI%r
zU#x&-gCTlOrt3ZkAUtxD;uiI*-@X8<N}>6BWv!n(8Qev_vi0D#CO3s1{<Zf8&d1mh
zR69xW!+{OA_{(JFADPtb3h@Fe&q2GVm@*@@pAG0u6;wB@$O|@XRI0q0rd5$mgs@xU
zz?Kw?YgLC)q27x5-Gb_i-^zjVpcVl;6fHt3{<UWGvenbfe*8cW-u|c*<vbLK-36D^
zEY5To#mf8ZQoMHZ+{e#UU3w%1$OXaGZu=HaeHps*<2w0Bt?F*KSSoI0D+?KJA~V?e
z6Qtr3%)g#zA0hY&E5`R*I@9>{h2Ji*tGO2CdF}gVM*Aq1tVMja?C9|+paU}to4+Km
zmvIqWz3@j*Tgl>QQ26Zx@f-kYY{9jYq_yEI<Hb(V4<E`hn;nmvgkjAC#I4-(-}~o?
zLAD|J;gMHVsev_|T+Hzge1LLZ2(T1p5*P&1yw#Kjy=~hWZ`t;lud<y6HJF)fFpZ7r
zTIdJINOdT>d^sZvw7!<G%ufbiZY|q4kxRL|E7b82S;PJ!15CC4WR18p$ytvaWIq<2
z)ved`+P>5jo_rVDUHhd<>P+WU^X$4VFQNF&Szj|i<u)v`ES9e+7YdGw`pnO$U$__>
zE6`8*{CM`*pAr?YoIHeh+3NfxOuxeMP#D-aeN7oc_~CQrbZy#eMTRl75Xjo=ck)?Y
z?Uc@35bJ3x6nn-6fzKvCO0p3QSzWZ>+oE~B65H@j+(n}atMMh{IGhsS`1dgqV8LD^
zk@TKD``S+e(5uOhpbr<?3eREy?$x!sd`5k7w$My{_Br=D`Uk)u;K@JHFTvxdt1e-D
zd=xrw?_>N{zF&>XpGJr=bMB-C_z)ZmJ)RXI1kx)U+tfD+m|p?J5;t-&0Oo=!LV;T6
zChL1B;W_c?B4oJ<s>iLk+7K2p+Z}7c+thgvZd=@EBlE%x!tMKGRBcs~5K3YlNH>ED
z5kdP@YG|Qs&{T|pcpI|jDaw>C)RdBvG?&)gTF|FqFXypV5#YNt(dK@H4K%p*{zNGw
zfjfF>Z8-I<fY^nrff&Kc^&D`kb`tu7ftA3`jUw9fyk+et4RZBGM(sSgd{_>*|IpBi
z0d+d6=9<Ex#Qi@+#MyjcZz*km?C|d}{{N&XewqVq;_Tav|MSy-f248&(D=0q@+TkO
zog8!vXT6R!k>fe~jvv(+(9o6&0_{b9lK0!Ax{H^}od?~Z`y-bBk6`lv?zh0R@5<5d
z`G14*?{oJ*2mAjG%Atb-x!p_#Wb*c*A+=n+%<wON0KeX5vvxyH;K=#4_4P1A?oW8{
zowbXb9P$re?fMw)dOKZrS=pc@l+OXyn$vWEdn(XR_|~Hz)$T%WqXR%ywHrtJci7<=
zSotaxS(uo7c3@LKk9|qK8|f6yqe4r^r}@pcjka*#w|Zn0L7=em>LyC&UU%i5VI_U$
z>{KY*Z#+<!wFLCC-g)Z-wgOo{DmXuRRU=XIz3xrzOAA3!UdPutWPEm$%9K8t1P2Fu
z_~x-pk*+$t%0BF@P%uP@I1G5M9Nl--9fb5LFP1+#S`6!D_vG0j+!OE4z<`G4hAHfR
zRsWj?(L9eZtwbd#5>PL%ns{Xsgp9z?>Gop<V?4IqsZBkb9g#RGr!gI-tFneldlg-F
zH~`wA0a9h0YiPq|7u3p7XV)F0Qd|wr1==*vn&SK|QBY3qu8+(8ovYj}%nsd2{e=@4
zfQLq4nhD#REKFC$4TIjFKQQS#4}AS1>*IQH@&ya0VwNv>!`D%-f*9>QxMmj%sr}t7
zGZ^aIc|%Qm{uP5n1*zxwme^mwu*a<lv#PJJFI6m}Uxh|)s`MX5ODH4R4mNnR66cVG
z`IFPLMKb=21!cC~XC2C0xbH)_&wCCjmQ$y-zc>x8C`oOhj-fTd2zfXGOTj6Vu&M=T
zYwXHTq8qw81J}1g7^dlw{hB>rpbz=H$IIM8XN8Tkq8uWISVxk$W#hLfWM6|f4jLxq
zdDVomOn_HL$A6;em)(C_y#FHtfIV0Gvkd?~wuaLsj_Y`=#2hQ&=S}XUZ296QP3vv#
zUrP|(0AuVrznR2J#7v?O&JkZrsPJ64%^RgwPQ=Zx0fm7+$BNLco-CXB<a^L+YKNd<
z#j~VwZVw7HvOKt7?2uhi8F^6P$k%T0{qAH|g3Tt0+dU~}c0<&mzArV5WPlsUkKxPM
zZ1b8F9e_k1%rdaaAL}#&v!LfcQDVeYWnp`5y1Z+oYW3f)yVi)${2JfhZd&TEW`{ZU
zRrrsVJ2a>(tj8>(gH*JY41UX|jI?&TEBVhR0YtOG`@O(TK-t|iUE(vmwIYbL0^r9N
zSSeao3oyhCX6kXo9jjTu0WF`kcHqih<}RKz?v8tSCwN1GH$^x95)&uVoHN^Un%Q}z
zAjPuCs=p0wLFN-3Dx;r*<K=RkB-rLB(rns4^QK$6j6bqdk1g3f@JwD3wa6453QAuB
zx#yZEObMFbYGCG+b@soi<Y5Z<n9wl{&4uR`?dt${i6vnz@-0(<86a&s!!GrTZ7q)%
z&*azlZ6(8R8MNDe@oB9RE(kpj;M4LVvqVV&gZgEO#o?ki{dc$UO6pk!AN?h)4@?2Q
zN!pdq7u3#uF)n*U(qPjx8kNi~P;`@M;{TVOpd$vIu)gXrO2kLi!uapcbX*$Zz?+R~
zw12O&>N*|^^qfzB@UPE@#qRh23X3Zwm%3yR#Rv|<d13X`S$bj0^9ZeES(kAmfb*>8
zYLCYUaVzBmZr<I%9aF$bs%aqj#efo*hrylkn6u}Szc0O2@=n+ip9e_7X5ic3N3SpC
z`!#$D$TT@#NDfGs4r+M7`+=<&XtYegh~ajX1agi`j|$+m{-Ca;*EvaYjdZ%*1;#i2
zxS<{=9Z~BOq&d^^r6Pz7fXn_Wt02Ahm^Ontdjl!|nn)B5LT<Q_By&jK9h?v>Xd-LG
z73HY(Gbbv*!n>`$f3?2B?=(|pBBJ4ORR*HZiCs=VaH7@A-vyX*j|BA<Da)L{7Yd>f
zk{bC9d!vF+_3|GYxKvd##B2U`x%YcYn+?4dyR@+chHm`&d<DRdac<nKrxIyA2&v@C
z7ptdHyX_s$<7J=v#iS|U4PL#CC~u+w@~+duoQwDJwt#TFgbJVlB)Okq{oK&Mq?x@Y
z#mFW)M1b!((Ir?{51%G<g|80D)))Fg{R}JfdTOp34SOo8MJ4Mam=y}I?6<TPsQt;X
z<L?-e@7#7;_Z7O6DlvULU%xBP1?0FK%AM=i11hMb0U$OwmMUf!@RoU5!0Z&4Z&qFI
zx>dEc8PJ@ktj)GvnG^#ypq$+ZOnyM+2lRe2pp@B%7fXV_0+vfBB5^ffH@7LEG{6ox
z#5NEBVGY8dpsBSRS98QOKe%*MC9`k4gA9s{MVh#a^NB&5iA?MObtnv|Dn3QP995!C
z9s6rbD=izB{lhkGsbgpa%enDlocmaTb-JSdO47*S_RMJQ#j6E?Y0jXk;0m7f18CjQ
ze?D>N0Y?l3t!gvsF%>3OFbawi@va0WnPa4Sz~*q>+@`--#uYPG4{I$%<W6$;4mUR+
zPz4v08Zg=A?O#MzE`+P0;~4h4UL`M&i03|S9#v1dtuv10DqyfVxsVHYAncctMTL-7
zGT?7}dx4zl`XjeHDK0C)VQiwgIzIx@&Gl8qB;9AvbeB}3{lAL?2NE`y(Uz4iiu;ZG
zGG5Au(EP#M!bIaYBzwbEqoszSf`#<Lgho-+m=+A`<7tvg8N!ir)Cg&bq+VmPs~e{9
zY>*+6VajiLI1|uT9b<ceBj%BoIpctv{U5_j!FcBxEHikkGA_FG4Qa`+tGX$$Tr)|0
z==77Jg7~=$ScLBNkutm9Iux#Abo3s9q=rlf{<r2#+xU2`eO3Tq!NXg*WIcbtXp*+w
zCt5#{+dn4-M;pgwT6U_^v3Ab&AT;QiIeWF02>NNX{*vF}elGUA1;8}TjDk0Jvitu6
zX9c<{iY*!<q?+q25cY<DQg1+|nHEW3d;(_4Xnd_%sy{nc&HD^%A0XSP9~d_i2ZiL$
zC4$bj#|oUY9!Ua-qddJKDmw9)CdW{vJsyEa7e3=u^fcdDn=Qi@ovIsYB3BhlS8}z)
zzZj8^xpS@5U+(6uTaSF$t9&lU36EKo2c~Rs$}DdMRnif-gYFC`-UU}hAgUaHzgq={
zQN|8_J<JE3NPn*7PZdDZcJB57UX_o9EM8Fv`m6R5;1HyeZ(??HqRM}H0i+8oY$+*Y
zH4mh>ZazLQXB__^Mk%q{xWi~q8=yLL`ycugo*f@!N!b7nM#%ZytN0r&uvKPwK*?3P
zCKT#Etip|^HLDeZG@JHQA|BLM<Vrn%H_d(m<F~AP;IfOsh=bRX6rh&<d=cTeeT^R@
zhn)<Re-Yfuhpc{s%+<}(*@0^W?-B9|G1p+GD9|1!zcK5>L=*IZSu9ZnJCVtLKnCR}
z=M$-^VR4dyFGQhAg`@SEi-Ur>5BdYp4wDXW1d;mleLuTWz*iWz+1J|L^^sbCp<zW1
z8J90l@^sU4FWTC-CAB%j36?ok)HOtaw_CAnWs(CW@#9_ubFne6N|SqsQBbC;TI4Th
z2zUt>-qY#o-dj=Mab+PZ`AVEgprl2uBw)$U0etd>SEAKMRMFH|t;XP6!}sjVdkzc<
zxegypB!(kYt3g)fSjQ4KKIQr#%G*}JuGD&mg-(&;nrYu{d9(akK|+mNQ-E1b?C&Nr
zpeUH}2DnPpcP&HKPyS@=G5WL1gxHw;d)IVx$5rSZGmsomuP6I7a7r1)FZ7MO8w<Si
zRa|4n<3bBjtNL%i(VD)o1e;hXjfd5wd|`-HwR12<IHEz+Qa63J*kzyuD@b|b(NVdC
zaJzbmSsEO2+Z5Rp5O2FQU03{NIMl8EulI_gauvPK%Gh;|x*BeCw^@}?|D~pwM`b9J
z$;VcF$YRqP<mQ(TZW4Ac6q6)d1+8qkN)qV(lI2i&Y|W_0HsnIoPJl~xnRaTiaeiCB
zVih*0#BJ6s9MI8CA0FX7esnPP2L>3QrMtfqnZTGQJ0F4bF;1%?ZS5biHGA(F_TXe#
zl%hp#`)NH*6jX10+yDY!vM+%dA{TJ4Nq~K=ihc?3sS|_uXH%>5aT8)_+RPu-U`#Vq
zFMWR}vCE*)nJ)W|q7^o2D{<Ny93E=2uK0~Za{0R}7!=Me@w@(VZmyAgla8L6JV4)2
z@6oN9GQ$Gut-G+*ZmfJ=RnDL45dPry6y(^R4|F8yU8HrBS9!wdPKRMZW&1TiBKp{Z
zQffR6yTM4{*Ft0iw+6Uuyz?szx&*IMm#`Ndz<_-Q+C_(!a<9|bhD;L8w#)7wNVB{e
zMoaxW(FLH(t|~PN3E=kX*W*tpyMQMMZFZ_?#mMLfc`$!yLpR-*UF>^YdyGg?o~U%W
z`u)M6(ma$4t6@(9DM105D&v!47%1IOg>4hD$r!-jZhQ@X-zI84WygO>3nfQ{<p=(G
z!^n06-vLlJmhfQ^e`hUy<zhqLCspz->yX!ra?fHqRm%XAV<@g1Uv1wmp72a**&Zs>
zTdd6%`X;aI)nz^LFs4H#NqPa|@M{tQcE=#=YU{^i3d=!!%dR6?2!qcz_U;u-eljYe
zs<ZO-d`dtCZjMTYvX9tbf_XQQaY2~EopSzR7AYI_y?n#^gz>A?W5NEHKT5Q+GEYa%
zKZINWPApJ^Ra+N-w)H1Uxm8GUj1NdyRa2pH<^7uE7Gc?3@7(8$BZaRh8=8+}Y=a*c
z60tD_{*^Fo7mHWscT-D7hn@dmoUv-Y;Uz`(Th+N<ivD|d@>go=-ay^R@wyVZx|#Zb
z|89BwwrN?DX$9KV+GRCVK?@kem|>^Uyf8t-TZJph7*iI0c4_?l20FM7%Ck&y#&U^C
z5t>Ebx-kB9(DJwPU;kUe<!bl)W4CF3V^sp^Lgy<Mz4I;dG{l?8YCH#8STAeiDLZuA
zOPo;>1Rj5obzeVa?Cy1ZhXDk<D+xb-PnFOH5Z-`G!$oO`*dSF72gFZKu9gIf+mhC6
zR5jOMZkxz|GjaWIYDU>Oxb-@+x+?(0dk=7YO}=>3<vPmSfgW}#z|>1h6!)a=n`J$D
z{OGquLcmT(y|In340O{}rvPw=8dm4Nrvk1kZ~UmwW`JKto}pmANb;!68&cIB^ng;a
zep*3Dh`S>$SoJ_cX&O2Mnj;>#N_(}}X?_`=ZoRaN4l4byh%PF+`Iy#Ly*Hi*8)H=3
z^@xC;ky4=OU(5HcGm#uHH2n1%3zS%O`+an=WL481fMz}c-;0rOL-ygp!Ip(qH^YRK
zo9~ZTz~;Eo1z^@^N`U5{)n)!HcJ+$Fq6OVH+019R**z<T+N2$47WO+4IyY9sh>iz(
zH#@1NK~#FBvd4DUU`VAEeErqK$dub=jqc6^gc0b03}*mzK=Xi?M;5kQuzBg;ebN$8
z)Jp&&k=i=2p$(iLeH)SJ7&|V;cnkqL?Yg<t<#WrbD5HMgIzQ{l{xJ26s_i6&@&bc0
zyKlqdVvS}nu3M42C~9a7T)#1ptLLx@XxNKA4a}o#4v__-ev_1LE5CdPoHhDh-|RKZ
zw(}%h69YFEgZ**`{765bD7>@z__{Km#i+jXnmXG|=O+W<#DVgaR=`5{d#JT%vE%kT
zx1u<I)$C`%$URYpL*P1ady62^_%#WT@xD4qDD}46l_y_1O(7HD13AAqb|+9&!By{b
za#;+F^h_KMbWnQ<71xd|rUDaORSEb<5=)`!^izaC9G+D^GPeheB8Da_BWmOc&3L|=
zTK)<3ZJYRnrqrM+^{ltGZW2<n{1Mz)7uurlj-PnSM3@ua?#z<{Um|)})*w7qR%BLI
z)Q#|(CJ6@l4OQ)Iyc(Ar3niX8H)EDHhh+h6IzOeJVXjqk?-AdyG=gCOxON5Hl~E;J
z<s4$Kmp?wR1w!Of!1w&jPPr?3`Gq6>z4Ba0DuB(~1E1KF57707R(#taiSL?tAJ(^_
zRs#dCds1(k7BS(djuE(UlxxEI02E9EaE+E<d{-yf_8j{4tgkQ9Um`<qC`cX9A8SPb
zzS;@sez&|p)44=fC!u$d^9OM0Vv3Mm>@jf!Lkj(-1S5rN1jfdMnwD*70G5+q&Nf`<
z<LSIKQE<S%=FhV>Yep$dBmu^x8{T1#%hrU8>t739qEyf!o%Rwz7lmS;qGUyl87Yav
zW%W-WxHA9a*=3+vE+@d+pU;8``90gvypQe->7UhPSa0l>ej5a<Gae%U?q%J5)^ujc
z`lH(taI&USF&NLDc>ZyvrFW3>^a|+5;m4=%t4)*w7g2akRl%Ore9m}$zT+Q~UIx!0
zO#}rOYd5{-;%q)qo5hDrSmnGNf77t_uUm2g56N;~LFf;tyt&yO@LAMCK?4Cxjh#p(
z=t_tJvbwS^a3&8>7%D`imlpTNIGY2Dpk<MGX9*ZRpXPNdE30Z(qaw@lNbaCzF(2t`
z6*ct0iOEs6uMzV>OdLqWv(bXhXIy7%FwezTeve&ehYqjC<9>E=R2PhpR`%raLbcee
zeHWFXSn&s**&>}3zv&j?B`R@~0$#OV=ivdQrP83TbSU$3=>Oi+{?~8B?bAQWM8zVJ
z!u*k451)co6yUU{Ob208Qd09x)>BqA<PPaI4!kQ`0L?8^D*|xp^uQfErM#1{<#Csd
zLr>?wtOiUwt-Z0sz{yI3t<1(~|Ec*?tJ#?2^ihjjc#NR_9jm>&3%8PTO&~kKaZf?B
zTF8a1Zvuy|%~Ozann@JMinHZN_WZ2qfmdn9ZZ6|+FB9NrL7KcIViCp6HisV0IWWAu
ziv#3>)wMFOz9T7k>}^2*=`spE`ZBJc8o(ey{73FO9X^PF2nq&F!KB&z=HWwyz5|tX
zDia|3k;vsF$-@T(@P&c^-59z)Xni>DJK%d)bpdI^($ZIp{V;TK@L3}Q7&X++;vMOu
zVhx5In6^bl<@h81SN{Arsbr!H7&UC5&t;CIVpT?70F;`zxa8=ENBD})0=M7*_f*u&
zh98QA4r1l8Jdj~JI=UYp*5drbZ~y;K6Vh@90q|~Os=*z5`+$?jzlyc+pUIfI&jXw`
z2ChAM`tAPvg8iQVOt`3O8ep-&VCgVlzLEz2b-pxM1>MNGgY@Az#yZ8Xl@w2-<PKT5
z_}>S;_#80ni5im@$HjiY9zA;J$Mm81pRkQ-0UFov<zeqCK6n?@&BogvIDXw(8}*6j
zpQ~Ry_@CM1=ue((89z3E<-fn@1XnHaU#bl!uy<bqxBvLhHD11WFf%WCKi)PGzxf|I
zHz5Y3BRpKx{fSltQIRiT`9S&ni2@REjKk~1e@_gqtb^kR^QnqnTI-i?19B_Fft^Hr
z=FC(82B3uN$G<<g>t%bu^9oe8o;86qxOl!4H#+rn^qW|57`LZH@cG?wy?eOfr*&+C
z<4jsSsrN}Sjr_j58FAa!UJ#1BNxrl@+c>?D*HJ5XF+s-}U<83QtFhEj54qKd)X%m^
zHX%6cb#{+=&V{Ym*Xl9X2V_BHDd_J8zjePS3^#Evp`SwNlON@*%fVvtJ929p?EX+c
z&huC`b<O{{;EK!Xpf>_pZ^<2hh!K7G`RDssem`HS0xP|XDZ-rDYzxIO`pt(!L1?jh
zi|Xy**Q8V!H4{KkUqAl}bMDLu`hXV$d_1DXN%tPqjp?tPthTX*`lm)24rvvIxPf!;
z;}Bwt9aZbO1j>e6ow9<&#M>0ti&uqUeeWG;hqU?i=iLNMB6Z^A#%ew(4{6`jpI}W}
z)4YoMBVK0n`t2j5sO?)GyE;4B??%OfC_JUUJ*RXEV~t{KCoFojcCS^5&p9<&c@<e#
z3x%F{Hi)<oQ07yTvH-u)tp>3#kCLv?a_7w6S?NGGN0lJzJRUkcgW8{ToQwY%u#+u>
z_UAU9Di)?h=S;=$D6BSdR$C<g!G+&&0_Xu=FPPO&+oZ6tO#LbEw19=B{7)(9+N?Hj
z>(Js4r25=@c<_T!ti|!e@9T<s-Dq<K%Xa&tky=#BKm>x+JOTKs^QXM*rj|o~`o36c
zQ|2~=z^Cus!&81+!MmACnz{nJLSnN$UQ{>;SdGr5i`vK`ar4<=3~<ScC-*Ny1jgw6
zJSH;OkjJU2u^>%wgz#3Xe0X%_ab4Dlc@hgNhQ%b{H`9#E%1(3aqo`{O0}Vr1-;eSU
zAqLJwrk$H>%TF|Kxi(Fz@gl80f?_*fQdL4p)gruqqQ;{I{fl&B+2{948pmZ6>IAJ#
z$D_X(Jx;sezmnIkrh;Zmc}uElkUIBfPwa|=KF~7Fs&=q0Bm{wCvL0=4p9j1eJIv4N
z|6_p&1h<MK_gC_H(GMW$9d)}d`_~K#_X>7N_~%_(2R<TNT3Siqe3v0&ypH6wvF)V(
z<+hF<-<fJfm;SVDzyMVkw=~qZ9L2UYkXxRon_F<u3n2YHWh|Z<O;QTYe(XXf#VHj#
zY!*m}$*&Z_98;;h9P^RSTa+Ha3!dPmIGBPW`;fKXeYn(JTw9r!Yy1A&!KriL#G4Ui
zm+YRb1b^D2VAdW$^R&v_!)5<n6Pd|{EqC4QxHqMRNy^>W44@pr_;TOzYEz_ltZv4m
zqNl3Rd<_7d&CMdCZ|;cdOQqHz{2L|*m6LbcdJ^%_xn0VdGA|C5M(ZZeV%<#JB7+36
zIyM^!l+k_X>OuPThUQz93OqR9uPZ3F(%fA7kX)=IN#2J&f9b2K?mEuM7d|F^^L^);
z?b`i1CB~g)dv4gcY>l{*pW2SuNi!AdFN^xT^4UDyS+6sqUANtFFHfi&jg{Wivu(XI
zN&Wm;Aok`og=Xg`=)L#+`h7u#jklX0+oFZrfdeI$pDN$alCD*s{~zqVcT`hr_b$3E
z*if;8f`APX5ZFo+5U@}b1e6kxP(-AcNG~C<Q4t%k1tLmS>4Xqk2rY>Mg3>|@fdmqf
zUP7n|5R%-*SI_5$-#!1_anCs8`$I>f$;!LlHQO_vIp;gxby`XTKu78g_{&}lV*ys6
z<B5*T8kOhlDb~Fc2!F#k)s~XLJ&b|Z!~lUReny6(kx=6!fRO(&a{tgREucLF`^4qf
zIV7JmBxZY`u}+-|B;rgVK!X|3Bu_F2Xp==sA$F4L{@g#(V+#+cR?IWT-@W7*&{Ocv
z8D>!#ayZeV_#Y!3x&ndRO5lzf)OyW0T2!?x_UPxGKvV6l<~Al~TgzN)^41|;f$lEj
zqn-2SQ;I<6YnDN>?v^bt{C*A}N1%XdEf}$r+R6)I^JT%S4@T59)={3Juq&OC)p(Uo
zEj5-Wq4KQcL1;0Pcb;vp1rikWl%tBP_Anr}w?8;Knn*kJ9njEXB$-=KpJr4}(wG%q
zrFq7lO>t{VG`m2EM3Iw|xb6FIA3b8EUOi|^Oj%=w70;aT_d-~*lK0%?*yZsbuIF6T
zcp*14|Hk;UhGUqVw((L$-sjsNnSG@4S?bd&EnKSEm&C)lwNWIvqHnIbB$RhL-2H?_
z?5ZW?;FYBwLq}w2cy`6^i=>(a>lN^Jnb{Wy=xJ%%&f!dS8<xE0F2-r%^-X28!s7C$
zzfD!mB2fF~mPlFn(1M{Ou!Xlub?k4G+WCqK--I!JEf-BSf-Od<crOkc;q*OWqECH(
zE}j`a3E}(6XSEY-J1A}yq<CH^y5*wD(F#O0Cey+F@I48gJ%JTjYp5W>pkz4}mZ94K
zzbvonAyT0zycl1;|K_J>TGqw2i{j9;=r(jmdGnr|{sd{elKIGC(DwtTYW3xP`eN_H
zNmkzGdHfuqX&^1~Bz<LSEbNw<Bk0c(vl<7RA;%HZ^S7Qsf&MPz@>u`^RV*%4-#YS6
z)r=5>_d+(`pOGvbeWIEU7CJ0#5UDOb*JcRxlt_}MdwGW@V)M3uRFgGIw-x}dE}A0U
zx$@Rz1W(g@${N#fwJCkLr!wtxReH;lvd<nYM*1S*silCNhXSMZ#w#c*GXrs0N{3o4
zJ>MYfi1gu!#ZGe-JzM-Q;lC<qtytkpJ%}^8%M=y(IL$|U)IRNEk>~fcUFgS4Y{`Qw
zmkkvb-nK-Sw(;-1qQb2j=<eaY-EynI*R^cvB~~$3wnn~VEW6EX2@MsbhZ;yN(BM+7
zXvaH;Y_#C*YDQO+?noE~@*uY&lrag_T>4E7l&EnogSOW!#tP%_m5egt{cz?OwJNpT
zS>@h1cbLk~smi%MGBZ9dJVxvI4q02IY;TOpl%Q1>z8>LLH)gCtfk|J(7KS2!vAH(u
zHdp0T_3k`RN`Y$zT-}0sK8lr<E|m=+Ll*)S#td2g2Qzu1Flc#}3s9$%vrgiOXsJF^
zV0_gQ(AaDR@UypXi7RvsY@b>ulE^J-n!1%fnjZn?{XEb<kN`~e;@e5<0hmK6U`7=v
zSr8R~7R;hk(Wy%6S|zhwpex^vr3-PV=`5UUA`vX2!G0xN4Or*-5kjIta#+6`heAyH
ztq>@6bP2zEG4kji@2%#utz%?878fOppdo*Ri6&dRzI<l+1-tu|;cu>pV2IN~@+Gxv
zl82?8Qz@5TT}|u#;fzKV4<{W>OIs!zi>UKiMJYPoje7_@FM3lKO2)JJK-8=z$pC{M
zL|=7(8@Tk9lz^+}e4vxOU!b8@f0US2IYfHu;ch=f=T)xdcOJpHN3zm~jU6MSEcUOS
zhkZYg1(U8<dz%9}o<bW$ppwp&Uf1-EF*d_{YFz$irdhuy5fgi}Kx>R|JZp*P%qXnO
z%4cfDgc}96JF47#o|?OB$EQD@e|Y*h(x2#V2k0+~wBJMj?w!5b(?;6Yr`rsCtA<#i
zq@pO*s4j(_@87e+#KZ?vuq4|lG;_Am8MRV)#nFq-KU?6T7d0U5x4f6ezm<P`YkgC@
zN5IX>u=nvlYCEey1tg`Nqt4g7Z1gBIa5)#&jJ?BjJEj)fT?F0#E+t29%a;c?d_Cl?
zsA?Jm(cWXG21_flQu!C+W8O`OL}3%28{`FSS%%0{_|r|Wety|dSD)ETe|uD>-RRj#
z>_S(+Qj`(FB1eOS!a=6R0toWr`aRzWK8szxFJ^R_NwJcZiRT>fU`l49Xv82E)?7PE
zn0zM?`sr$(XsA5Q_Bb73;Uyn1{q^ZUUCc+waOFvCvFbvtQ?*m_N9Jn-JT@*@b|<_t
z(ZDcRQ+B(Y?ZKf2r)L8_Sih#;Po4A|gORMBx5u5lO!FAdXDhkU)_)F-VvEO0gLDd@
zUmobOc1z4SCa;jkm><|MUnltw9^%{7aTO|kFxwgkxR)S2m6N*AI(!yhu%wX@j)VWO
zmF{(J&_qQfSCUKD9x^=qweo;rt2l0?u|pbPc!QcGw8QyhHSsG(=y-tN0KOkqE;8l(
zA!ntb9yAqo4;Rd`y-8%Lstp&1`VZi*BN7`XSR~j|a!=^N94(q*?+2rB2Z9luaB>iK
zgC{-rm&8G>-O1B+?9Z;n^Oq?Q44Qq{MuvgB(wb$_jh*KLeH8u@&iV!h{>vRh)*`mE
zqCv6bK@OM^nmOfF)0O%_!sF-9pVr4uRL6><YAzeHZYLE8jn!mp1TZqdg*?&@<2ZO{
zFfU^zNh=(fVdN1R9?3nP6YZb%NSL4D@ZiCk<CC^4o&|>vANFh1h;>_Nt#WBP6R5a4
z++(5K__&C`O`Y88uU@dX35OAs&a&xJ-jP}v_?CZ56h0mCbkU6{m+XL;)vEX%+3?Z>
zLM#_LhkvA<&ELIKBY6xZ<oPk5FD@X+(KjUBra+5&+t2<3AJ6u<AnM99z9&(HMeKp|
z%Nig^N=jkcVS{eg;|JkE5PILF6=k`!GD;|h>@WC$@+$IkM&2M68N_^SPiO>Ls5m;V
z<x9+k1PAG++Gvf^t+V_Q^QdEDt09F7i?%VAmpzw$Ci_?xt*$OFDKY565WX5t-zfG5
zO&>i_Sxdyy*fgD0uB+Xjs^jmMXb+1Zf|h@ZCR)-FiQ;z-<rPCiAKgvjr|&dsCAm8&
z^f!w`?>(R`9z*}$r~!!<wGF}(mULF9pCt%?!P-=>#Rp;4&eb8yX&heYmU)!Cq)P`~
zN^SVfR)4z1%oUL&1$mGC7p4|lw%n5@#CCim_?q1tm5J(VUvOnD;jnkqTgqv{_N9Ep
zomA5wC+H&E1s_0{)<mG1bPAuc1*}cB2c)+Onv$>h&We6lb;Ywk&nDju;G32d9%+JP
zV@S=7P8C9@^{yl{Y~OAd)58Cm%aXrI`5|&VIyfY&Fzg*XH&)I75$Hh44k9<#!n|f-
z=cZSRuv)7F=DD)5=iPh8zKwnv%?Q|?-jJ3`Cdd!M9MWCFevRO+2Jve@41&nCqAEs}
zIm-(uZk(#JVZ<OOdBN%1)|oNeps&c6D1=9wD8@ER6AR5PDKXi$BlU+<mDC`I!U)TB
zhg5W-Rh^j*Gn)KDvP3QU$~Lt9NN~Z~HW?Il2!yrs{i@}DMF%w5DC1gcke-TW7h-L&
zA>d$I$}D%pg4QF88IWh6yY6EWr^ya|ap9Zz#n49?#-6Z2Y~aVp<?_iMkSj#J<~Ex;
z48GXkK8Q>~n=jhl2dmd$juw?aCV`kC$*Ca{mdu*`o0M2-;^K^Fzy6{<WTYp!nw<QW
zd@EuwxGm5-WbP*I<xg^yiXdbJcHd4!#Ewpb4!RJ!0MV>nl8MAFBneX~O^j2hl_p$}
z5?=NWy5wZEDAOe4!9deEd8{GFyjqxxRw1`=q>SWGyqy4@XB&J_d~~KX#NY23TUVDC
zwE$nRsS)I;^uf=}_m7=`Pt^K??{O)J-GxUw`#-){QWo=cxnNis#n)`7@sod&o_r*g
zd7h*aA3uP(lvF)Woq7egRCTjWiz|hF!Lu&(5J?;_DL;u!H)u~<X_d0&5;N`?hiE0#
zq{0j(bCM4!Qw$`bD-WYs$iy2tBh@DI(HiNDwB%9TaZ}R8#c1n$FH%0Ac{fXKxD@z~
zArTKZXzI;(qA(Xo4UV~fp09V{ElanXIHVQhSg-f!1c{GNz+Hjn5v4KT?mI!W6oNV+
zFubkv&|hPXS}<VIpa^Fkkwlv+Sl|*`+cYqCIjPX;lQI&%^YyR#31Z>ncya;Q*~XV6
zdc<DxpS1v@A&e)+Q+pW<9NlVZy3(Pvj;+PBDl9(S=Fh5Rv`wMAVknaz_0qfJjkQn(
z1s60}i%*g+agJ*!kGKZXj+-*PMMg(QMyjLTX}lk%JpRZrXN^z!`O^E;XUs6GIMqRH
zYWQ$_yxWzJ5su+uydn9o_4R5|WIdP?LkllOL@s+_d?Ud~ZvW?kb5S**ZP3a6xVRgV
z7h1iQ5T52WaI?9l(V&l@^zb7HmMZSi>QJ-k5~u6dB=1gyjIRSCLH4}ZMXg5hd@Bl7
zn*JGxp?2~wb~xsh{Km*t4K4&>;7`4;4OJb*6?;!vJZzLO*quk@!dW1n`X)@-@NDf}
zR0E8zT+^vx8~kqm@v+wNWbC!Rl+mZbvJ=kq_PLzC7pp&hCegxNa&4e*6xbgwEU6*1
zt5e3Hw~AL^1+{9Nt0OWob5L5^G4%OH<ax|WX>ftf0(J5`MLGaniECbw;8u+S@+I_B
zY*iblM!!4gR!EphAF&ng-XA(85{sFqHsO0U`9Wj-@E4T?Ob7?X8d_=yqUCc3NRdBn
z!2#(N_519eDXP?9;4DCx0*n!Z-05rn;oKTHOR1K9>w94sj6RDi9_zxv>}8s_#b$cY
zUZsD|z|G=5hLM**Y0fi`XwBj%4|DoTak#sO+|+8rEz>$EWF!nmvvMuW!R&m(5pjSz
zDvtST2hrlf^D1`ylD&%<Km5FRmYO}!go<_W%i|^|8?@9WKoaN9xedQ7E%PC|2_;FM
zJtwU~!h}>8!dbHW7)Y!Em!aFr^C)(w%s>#M^ves2-ooB3Z-9zIyx&i$F?RZ8Ak;=%
z*nVhBRa<o*WofzC!FY89?mqYA!&LB4U_a-1TKYnMHGvA9$rnK_5PxD!u1KZ?#jqFR
zO=s?o8Hu`G;rIgtru`JfIkS3JeRkJ{TV1_+-()-=IO=)$8X|<el=`u=xQFHiX(E44
z%yca5MU=`~B-Mh*0%1}Fz9~>3WilCTGc9&l-^^Sr1Ck?I8K)w6DP$1qdB1Nc;ZWab
zIV!cnOClI~=rqVV6mboAzjN{~BTVOG+$ESuk5wzXXD@>nqVfekS?r?*7LfB*DnlxV
z(UVvrXKDhehYb=E%#rfq%+_1??|phUN_3+T`nxQoonmEP!h5pxX+{P<B2_c2^y_`N
zZ8Dm#0+ShJw=hH?#MezEd`Ax(1GTgXpd@tfM?^9_3&{!4-sV_mCc!7mYt`1Qz)}2M
z#aOK}53M$0s9H12eSUAnEB1**prrepjTE=N7pL(+UZTJw9+pv?Huw{M(aY2fwI5m}
z!=UTLTl~z%jde9Vka(6x9l%J|7A78%ai{2GUeG~LNTeEpb2Thnggs5OcO}8Z5h#m7
z+kKTeRcfXFnq2hS3<d;MoC~e-wj!w$X;A2`&ZVn%!D1}ND0gJW7t$C9jYluX91&%E
zx9yOqTDRXC(;_E(oKU4N;eVc!z@X-_<F21_ut6myR?JJ^aU=H1XqH+La4UtJ`H%kT
z8UAdS?V90FS%xc$KKuWYyw~;%O1Hc7;jTklfJ~2`XkeL<R&bf-+PH#Y_@pZ45^XD6
z!AKmzmNfJ?ehe=y9{N$ITg8LQFq6T`jZMQxgc8S@)#5!n#luEtAS^Ze?mN-K-U)~Z
zNEC7zPj8Fj$RF@9=eF{2-Ja*%9sQl~zY|iOzi>a_*xybM)R>lsb|oaS0_f|LxZG$I
z`{XgPpwHA90s@30K0kb}N{bNka|;@Q-VK2{`d;t=bG;vH0wE&!gzXH-in529Ehg9o
zR^89<MeiM4HnHfb=V#c^-qugm8JO5yb&HCmfZj^FgK4mWBQ1#nY|ueyRH}oF8)Yef
zF^UCpa&Ekc`?G`6;>VZ@%?iBm)FxD~1Q(*%M|;M%#J08@*AEB+L^nk3k$y9X3Y97J
z<O@V8s9f-NfE7WGT7L6vY|DYWv?h9&B&|h=^z7(42=VGm$!>XN;jFHy<CSq=J?U@|
zWks-!qH?0ZEGDow=)(9S$Ytk_1;NKNP=k;B3)=)3$;X)NjM34`q$O%c0<^&D2nus9
zyE0KApqKw7RM#DK2u1kH&+yE`VNaC&2&R79i+MlyLp9jzi4(uqm|gOu8y*@32bYY=
zYJSDod*1LJg@cQUYsmtO(ON|wF_G&Qjtb)io%uqHVA<w6dYMn?UkLsJWz9*DId(Y6
z4NE%j^WW`Y>-@^x>TuIix=wPUt#hKwn5lAT+7v$nnYy~_suk}339>Ljj$+L>P|jDw
z7)@%;mzBPDxkKk{zFYaQR>M`M!P-oQZbq6`!(?P#X}^L!ZR_t4b|B+3l%I&h$gg4M
zDEJ%Yk7?`^L0JiIv90`!ZOu=DJr&0mjQUbmHNUT&_|-~&JMjG7EUvQ4{!3VhRT4sv
zmJ|iA`7VFn4CFMB{EUp{-?PW;o;kAR^`bCGN=7D70%~H?v$Lg@J~aiwp@2UW?3Ey9
z-cEQz8Sa_?-8b^x28K4`PQi2)&_WpV%e_gMk$1d>B55Y@meK2<hlcfYy8{ynqVIYX
zSmz~I?dM;bcDx$u<{z(o23Z=dpZ7?oKnCydWs2tA%l~HiVP%|5c;lde&Ddz3OK<_W
za>kQO>E|YlHsqFE&Za6)e>LdHx5ONGg+)~HkwBl$X;#jxxJ--nILmyEduKz;&+ajX
z#&oHb_aiRaEx1ju_>En7<xdN}=?b=Sh^IA>A(ISb3NSR`wF$)nUBP+F?4q3Ql`-z>
z)+7a{C1Z#eXTaxn9~aSd@L%eZx$!W08zaQK_$8^nDp;WZPG30QEicHi01T&f67HHd
z-VCCdNwxjTiJrW|_er@%fH2_}g3{vpMQGYBXW53V7-HsmYvC!MGGb5k4(|X^7XE!o
zW=yq3F1-zI=oNoh#V~^GXsg_6+lg>FT11}5w;Hs2r;nWPVMV4!hjpW)KI<~HMODt$
z(2h7oX#U!i(jEdZiAZNQraY9yiFIfC%2#Xdy^@(OS3Tb11Z)0KJj;cMo=_3U`y7>+
zS$Xsuw43~gQl`qsi`%Wv7cnW9S^HkLAbB{U$jD{~B_7bXxw9_djB)``E%K2Mc6<=l
z{#5Z7?(&b%=VY%2;cpomH><PQ;^7mqT8VjVBZ`!|OljY~ds69>llYw1w@cNV`2Ys(
zYQk>I@0i8KDi;6qOM9OE+97zg9$+Z-rn`5j6#e}9z}#$E`N8lynR}qOZ2QllA$VNL
zV3<TQNPc49Uu^C6GXTr_+IG90yU2*uAB0KvuC#~G0PfLV>ONvdwj%b`EB<C~*IyZB
zmn49V>q_}Fe}R9txvA+PPqIF?N$-zqXMh_!d;cSrkNM)oi|wrB_L}yizXq~a27k=r
z&<|aOeo?M}zl{(CZU}QArui?N;lF5H7g>Pq?upB?`St4m{)*N4t3kBum*svHv436T
z>Id}pT@0|n+kj2E`vWc?fg9x?tl0bS)&24+qUX@b8i?#Y@}{FVu6~FF<V*JH(53%j
zvH#tae?OOhzWU#i6d+vSHK=?|x`@9j5KV8tp4K1_<wYIRn7@`Lre5qYB)QYO;pLh>
z$9L3i;P*0Qxr>Onwt)zvvq^el%zR|B=bWw7?u%Rzlyrfa{VjC4hlTHn@B-wcF|<Lf
zdr|zC7Iz(Ubef%Y<`=99{0JUrEMgp~zF9|RG{3f45btN)X;Gp&QET!&|DL7cwNMT9
zV&9=dvRCS6R%Y43A>5Xp>L~x#$Mn)P>nv~-rfYxdA*)_WH1wW#Fj`lm%(`(VDZd!%
zyb96uUe)KwV@zUWrhW)a%8rX`y1w5}Q8jm71c!UsXzX{g4Y#~o$nS*gA?l&;(puwz
zPVw~QXhi+SllOr!gZubS1Cd`X{qq5hcYk8?1o#JGbtaO=_wvdzj}0i5VAYFr3#=No
zYWg`VPc^!fd{}<0F+#WuQOUPwvg(v4u^Rl~N%RhN6b*Hr6d-!|;nd7jh*y#tD`lg4
zpLLs8_V%jwQ<mTwb$Q+jZr)_KXJpjgbEyyF=rzLmVe1;Qgg6a12O;zlwGDe!ZczMY
zk+$-P+#W;Ju*;lyR(|2za?kV+%{$R|1Kd1PM|~3oT_+n?O3X(*O&o~MrDw5Ap2guK
zFc{tOY@=ICMzfM%qGI@cPnDvRt9_AtNopT6^7G9gc9T}Yyy3O2*rJN|B?;M!pfiC6
zT^-e#m0|MD$ZoAPtE?`z<79`xytySPt7X_Sm7--(?KuJV_G(<S)AwhAE1P8Ud?ef(
zW>P<1(}2-zD_m`3)E?I7RTSt$U>4Jb5U=15P+A+1dlssOXw^5|M1`7XvT5H<8D6)n
zY%KGjv8>2dG@+EsV~?Qatc{<;nG`vlu@fm-6_)9JuL<-1ma%5{cBjrax%oH8kl=dd
z-W>E$UAn&Y_p^a8>(}KjhfxLs1W<5RO0#So#nsT>F_qBTBYH@Y9>2Bqo=I-pOE<J(
zH1TT`y2B{7Zb(D`xfIJs-*}GC=Z3@2pU;MQ-i15CyzJfI$V5Geid>YxAlF%DJP%Jf
zkZ}f@o$F~;!v;DZ4*LximCw}hpkdKCTTu2#m<jNKoE)uYi?M>B0gWah>78N*Jn60x
z0<xnJe0HK;Oe%@x_(qUpJ8CosT2tw!>JSQgn%49+!a9NE;gBTik^B~}`X|^ESe_`A
zuv*iO)h@bP$up8l!j#?ALgu&k?R0j%&pN_;>BC<w(66ZjM!zC;@$WIeV>JSV^J|`l
zk!|mb^(g_*NpG;7)(5yFc8*nHF5so<q+EkE8(DCcn9vzfqNKS-^|{Jol`+d@XkKBM
zHxl0(u7S~AkuVqTQ85g}y+KGCPh@u2A4^puVy^RIhRDtO<0-S>d|0PPD+aojrY85W
z<{fXQD;oC7*G00ZHCFF4UrJA8Nkr=3dQD826E%M@5+Y_hlNJHE!9@yr52xtUZ6PtT
zZupJ_@sbbt!m$S1_A6X_-2Pt8@7RY$iN94!m?tTJG>s;6TD^Z*Z{i3(sBQ%&^-%th
z4Z=;e_6wuOuz#}39VnHTqyj9*-M?Uv+X*s-oiAch?XxzfN?taGOg+tSfrviY?QQyb
zm8;w)p&qyI=~+oIU1tlQulxC@@XMtw11dSWgUq*Uce8mlZ-;F6_GXuckD86QNP;HT
zw%j8-mS*l?KZppt-wKt{h)+F)VC$i1uSvGsd+iZJ*dp52asHjFwk~UMaGpXo$`8S7
zWF&u_8Y?6|rs*p!l(l*3K+Vy9E!&#Q8sFZUq3jf-hL;vt2gZ0XYI$!@*vhg2ahgon
zc1dY1!ci@N<R{vtVt7W}s_+Hp(m-?6keKxh?#=xyKaVV~24tj)IHz8SV1zSYn_Gb`
zvnC`10az5V#2X8}n;AuI?lP<+yEO;wE>txBQ4<0~aSmk`jyWx!k?B5lrU!eosLs}<
z*C48Ne^d8IjUGl``yqkC%}#|%I(+~*vF*O-T5OoK_sD&ZuPl}3ChJsx{s~VwMidl3
z0Lq~O?jm5us+3uU+#efj9{qXkg)#qPw=<ty4QsNTM6zYcy%3)JacPNmk;wOjg-^~Q
z;iP>AE8%q4T=|}CAu8q7b9<J2*Fmg_(%c_Q$<<VDNFj9vXGuuy=o6>fUH%=s(<6O4
zTu}G6Rkm%iMCBoca_{Mq8h!tpEO=6}gX6U<W%t7<s4f~PlT25ICn?)=RQTMq%rLkr
z5Zqj|np19A=q=B%1`pWXy@%{tb*wU9X4Zam2c@*7;Pj76T@)@cNb*X<aI>DliNz2l
zKWmGvjpXlA`DVfJ{@$9zOA!lhjsZsLxK8Ze%b%R{XM)a<;0l*84(#lSZ&cSAJ{^Za
z7&`MKOV*cg<41Gy(G|E_m2r|0RX#&1U8Zfbt$lpxIZ$x#Mx{tY8N2o}WPit;#M79!
z$TfzoA*0)%nN^*aA{w85m$8-&mGK@DC0w}Boe(>36U0Cd+<^)P$S<RBD;Uwwf(Hjm
z!Jp*RuT*!q^Ba&*HMH^@kHM!H$PcX52OlxS1cAK_<m)@MR#IZs@uhYjdavp=(g`A{
z{JqEBd+=vSL_7oCrKE1lh9m-=xScQEczYJf#z}kw&RUgCyrC@vrphkOVX7lTS2U`N
zz7abyR|jlUdhKbC-(hp_Z~||4sMFx%6J4QNtjB@iNCvF#3&0u*4S}XfN2%b6%y==o
zkESd__YW$LILAarG-|f^@-UU5i}f+9GC7|bRF1i!YA}#J@8~`BAv8mI$}Yqb3R5<o
z4?lb|*H~0&vueWVUD~&Uc%zuFh0j)7y40mQUY4OKd&@u0QkzD5-RM9V;_vo(4|BEU
zLJQa4u`*2+#%cZyOy@EKar@k{MA|+ytL~+b&F}8$wkyBiU}57K^831a(P)d;vCtL^
z8Ja#hC<>WLkk1Rqa;#Zsq{k0V;wZ)WML-x}n^y<u>g%xgg~PGLxpe;!$*&Zz5_C*M
zEjv4`D$M#`VR)N0axv3#Y4Yv3atyjoM&x1gidUEBHIf)zhT#x_Bc|ZJZi1I)KnoNB
zz-Z2f({|GbbkPApSpjbNf+CviO6hHjD|p?+6KQni!hILC%t*ct5~1XruM@Zqkr`-v
z_eEc^zo3-A<Fx~?uhu_hl^>jzGPQ7Pv7PWz=sxy!ye~4+?R*U;+C=u7&0C9)fI0SW
zkC9q+b*v1#XER97g9Tkf5#NZTq0cl|^SaRx1R8rt&d`<cI8dfFKJLKO;{b-sIGH?%
zjU<(C9k4xO`TiIsg#;Ri?UgljU^dMHSsAWlKlQkm1eU)0zS0as1BaD~9*QKZ`{_SI
zk1E7HK+m!+Ese+h(BBa$U4xn1mtJ=JDBR}@M{|n|8L5ngORHh+vcc~mQ5+Z$p}^mt
zKy*MIbD?9~F{nR~K(9v-7S2jl81if4zAqHR6Eg`wtbthdtRs&J3AueXl4`pB!k>NW
zc8H3x#fd)M0K@x1cEF|~mh7xeGM@lq`X@E7Nh;4r<S-?lM`oYgzA!jswV8j>jCj7A
z;rRy%_fW!Bf4~xTqF+}FS<nm29a|ndG_YKP8pQ(XR$)$+s=Lj7hUh@a&nX*!PXt@G
z9#iL*D_(ZvC4Ur<Z<V4OuADap6u0wFP1mFYcWz)mx?^X#T8-sh%qe9W`gbabLuuZo
zUSLfKjw;K$OMziz<E>@6lWtPybd!pVpT+DyAMbE#X-Ise^8Ubn^|ADAB}53jp?Oqs
z%)x)6)P1paexJn(`1nUw_<7=RyjoS9Hr1ZCt0+#l{4Of6*QvPN;*Urc=rA4@QXuof
zLC@#<Ys3&lUUXWRlK!Ehe-HZ`5rvscfjxT5%hLVeKp$&R7QhWfqeECwTIn#_US30O
zd-ouuZCQ0Q6zURlRXdWU{0Qvtxim=O^Qa{s`SWGI8?puEv&Bch_L;=Pt(2moP#_X}
za?Q(^j2OU=+PWheJ!>N1kgXPzlpPoZzcf+vOrh?+mCtOe*5&+sH}ow;pONXb)xrsI
zB*Z>6xy&+LHS;t3o?)1J4wJh*ASODmq>2px>^hx0Rarb9u49`8z4-YhyJ7o^#>PtV
z)a2ypTDIhvkW0hb<2zMPVc>H8D@9jY{$#)9(>TY@j=(f&jW^VmMX2kRk$OZ!{h6x&
z2FU;M3V^XdRER@As;wL#E6vvhUsx3V1?m3t?Q>-Sd+$p1mXTO!O4JeVJ)<*mYs&q*
z-uR>Af*UXM<bk^Y0zRmey7yP!;h)#Mdh!r}#n0Fa9^Z79%~fq+KBZo_-=$-lNcV3M
zHxB^y-cRp6+`DNV{Xq#J;c>U?`~Cm8`G2hfK%S?s0oCh=oZejgHB0ob6pnTRkQ2~0
zlzg(813d72d&F~o#;c}$^mwd^XP>g|K*<o;KgQ=3!mlSD;kWcdnOx{_9YIA%MWeo<
zx*yva_-hl)0;`tj-)!@Q%Vrpcu4j6EXF|_dIKs`V#@m&@D4R2u)*}ohK6q8=ovDF3
zFYf;Wdfgm8+HbNcALQ0mp5FlBKUiSCDue0NYOAoEn9LyO2V&|$?>TV5r#nvS+d%!m
zOMM0YGaV^0#_Y_i3PML*n8#C(ikyjlS9V)(=@zj9tDxf2P@}n$r42Yo*EU(V6tIOz
z;+1NvtfR!Lp$ev~7p9mW6>5(JjarOzJCGvz1nWDwl4E02eJ@f)rViot{)y{<+579#
z2Y^|*OTHvGE-FjzCW9z@H@pzpE)@RO^?vM;ui&_WJ&oCd)I@W$YH!HE7nbZF&uZDu
zf`V={LOLN2t(&*aR*``eOyth!a~mgePEKwIU@zW-DU6gV=+3;j6xC6F3Dy>O9d2fZ
z@N_GX(=3P%n4IRXGEOToc>>Lugv-AwyMQuz|GikvCF;mJ2H@QZ#nf1<w1N>zI_CPf
zo_BmmlS*0&zKfM%B#wY4Y4RwdxVuck0U0{R=4G4eWdmmPZ|s3}Xc^BUv?s*wF$19G
z{t54@(ed&Sx3CDn8EF%VM6&PHS;OhXtk=Vqq}V+1F;{A$#LQZK#jzzu+NT#gmq9)F
znzEb5ZSw5^<`CJ-NMA0yYAk>Ljz2o#h<L{E(_=iP01p2vesgPEWLdpsbib^j9wV;&
z%gzj(@`W1t3ktN$uob+?*RS<11mt0VUA#w@#ER`F#bFb+t~s&O1~NMNMEs@sJz0zW
zQkrtQd=lmWbGn3PwU%76QE)~Uigbe11FY<NzJX>EL1q)94rHa?#3~R~W!Qncj&W0~
z&rYIIugpRB==v%)!4F0Jn_e#nAdAP^(<;XV1t-~Xpv9h&36i~b#Gm)`;{6SUv{w7%
zgIXxU*y|Ju9-->UyB&UKy0vavCo*KME>yG#78ep|;Dc`QHON==ye=tJPmx|K(RUpy
zd?DPfp_9I5ogW)6-SH3HXt8H>IVurh=$2xnak7s176S!=^4eypVPUmrnr$wJ_0LSK
z`uj)Pa`JE9Sk0^y+A25>HVomP-^sj5bn2T+n!lUYgc!cQ;1FPF>U|G>;i~4toFkl!
z@V6pOPZ%TLCs!H8=5eDulY9(Lwg=mYAvt;e9H@+Nw4DS8^C(Gs1~^WIG8g>@Ki<=S
z9(|YK^#Tx*kJ(`<3|p5)nv~AMTfvDO^P^!;K08;fKOvsey-GEw`pV)$sr>d*{#S|t
zjJ^99$)h#GK6#wV;Nd5stV@HvHl{=+^=kyV3w{AMr9Z8MXm_BJ^yH6k06J3sYK`z3
zP~<VAwVtc7y8+9i_q~fv)uP9TvaW~@NVZ~s3;tLYqyEoYfQeVvvn0Q++Qlf2sFo!j
z31}^bb@kVHl+Gj{v7d+R8Q5@I+iwvE)`L=rOqn>lU1+hP{wCB5J`Ada0{om-$#v07
z4>;&v{2JmmFT^XlP3^pC6!WJ4AeQe328AHn%DOIZYwm`ykE90Pd}|8?Em1T=*U}A2
zzB6$4FndhsD3Ezs0Ll|QN0tBtIQe#vzJ|aN(u(!n`4Nho;TY~L_o)W#REcPL-&8V9
zaO!7W37S^^ea8844$AC7=<6BbO8b4msMs6GLXPHp!~G28fXLX$c+}AmB_LvMeleZU
zD~uj)G`1aFo$GypBd$g0*?3w8@#>m<G+=JdtOvC*3+c950KA{MOCNZ-_{`dk<}iGt
znRx1q5$m;;Rv7y|%(u3d-9Tm&+})SH8)t>AF1D5U^8~rZ-1D@^iFB?B`M#Z76f1fq
zXpj@Rt<?WB6SuN36WCQ$K1r3hYZ$yAakkZpL^}}L;JV=u=q=l8@2u+pfvTT-o2_Wf
z;N6+59nx#`H*?Z2ct*vvARiO-?<Jl$uzF)R0lJx9WA}`o!Db}nE9|$%S0dn@eT5E>
z0i*<G;Zmm_|8zF86W8ZelvwjpDy!ONx!k~l8pAi>h#65;9k`bx$Jg198O5>?C+fmf
zjD2!~5G6q8Z2S~L6vP|}uRI!Ze_*r#R5iBpm2cI-GYcGnFZs|3Q}|Kvq~!4)27RQl
zh@Cj`+%}JU=}G{PVn-mV(}b!uNt%=V4BuCXH4fSx0FoBzJkaFUg$C=b410M=4{FRb
zJin_4zN3W3^Bt8wnrIH3@mI{OQ7!3Is`h+8Z2Qde{YlClOtJg6I(GIlu#c}zVYJbr
zAwtTY)RlT^z(}rx6Xglj>1v%guD^Ej?`vaE<u(RUS97<Y1~B^lf`V7X1aYi$Rm?<k
zp@W!ZHj>ilPV)?v`Gn0NjNbBc47HJP+FA$Y|3KpasNBd}`~mb!foB}WS%Kyj$|zbu
zW=10m1p4JjlW6fSl~!>oO|2$1z|tai02pm`RP0#7&Sxy(S$zWAwR%f9TzF2!IXnid
zhPB6h0boN|!|P`=aoKb1Lev6e3x?<oF$#i6JiBm0pllY9ChM*Hu$s}mvNjIPd6@c_
z{S?|~+ozU6v;<~@M)`G0z|BWlQAQ!5k!(EtwA(cKGZ1xa+6M8~-cO~!A@aeKes|0=
z8qhM;TfFVr;d?A!K%KsEz;bnYm$nC>yIFcyDsESMrDX!y)DCX}ISY2#<pGtDx_Jd<
zo9IZEaX9G1M7m%_r#!eUI#6NlORPlI2s}m2f(k{9dzN-n2i$hB1CSOA>-9eH%oPA&
zITgs<D!qg^$+>NlcLS=ZRf7l8q8>L$jmB1X`x~#%DCZSdDSXh5MVkE$ZHBpt`=jk)
z9_MQyEm=&BXU109bhWb;t&UiS+To)!$-4!qDp?wc8;}wAXY{!IzE>|57Zhn2N#W}9
zfWDN5P@n<=cbHrq?M8oBU3N2`+8WQ=_v-DHsKEuoZjFt}mxw#N*X`C4a07iviiC@~
zeHP*_M5K)hWOmq<9BNp=Y>bp}r@FbSgt^rs^gWmllH~`mi^$e^NmTc!=g?B@lTvFb
z5z1|%etkE3o~loN9qd<mDc(UT1hv<nk@7*Fdm$bGahFtNcQeF;<O!aq-4Wzw>HMX3
zXz;3+PVlQ*wyNEc$|;C?d8$Z!<e;Dr_&1FTi+r#IxAy00%w$--m#c6oX_dH4t+TKY
z0UktjW%ttKA4BN|if$}FI^L!PARlrq@X}0(B_)CB^D^J>=a7u`eLO`Fm#7+`7~lz1
z23-`FuVJJdA5%7@))>~vrDDmR*6d-a)FUDpf*MgDSBtv-T4wP#X?YsEj;Y65EG1;%
zL!ve%KmCA2^uDR&(XfY(#xp?<NGb={9UjBi!xE!WJ)gS`aynopN&$>2cPd2(v;bHZ
z9~*Fh<-}3S{hnHO6^JCyLEJ7^)4)F*;ESW2ASr)es%7&|P}<=5;yUHeumVtDiu+gr
z(QXPz59vcG4@quI6#J!RM1DTnrcs;ZL@%l=ycqmM{sOWm*cdgB8G(mXPPJNNIX1=N
zuQ}z$odBMkgJ_B@yO4;wHb5;zef52tR%kWuR3ceC^>L@P4YyyIQ$kk3Ox!9i+}@VI
zrq9EiPwJ#r8Y6u?`!5$DL;UXX44*$MMABVZkZ+CZw9$oR$B{xj$c{Eir|@UK)%@R(
zsFM;S#1iwKzPw^NMdVbG;T?-%^D5d-FI&oqJNzA#?61V*zyf2Cv*o|x4Xp|e4NcBi
z_yR>z93+pLUEW$*&aCVKg?ha1jB{f)H}uMBv>^o{)48bVhC=t4S4dk7L_|^1xz!aF
zKudyp+Gs}D<Kg>Dl#zSyx@$y5ul%(-@b4k@F1v{5yBO&yb{~!}@Ye<kjtBSh_o@hO
ztz(~J$?|`H7ZPCD4S3#XnX<wgW0#28g8&ND46T@OJ<H#1?j#x4*t|)%@Q0;!@|5uQ
zZN}}-OzR@y)h8j@x_#e{Z*q#oQ!4;gb$=?`j3@$F?mq#Hcx|hX>LwTxz+WGMj!^;h
zdHQDj8!!<y6ToJF{$ah*iP?V#a94AI-s2mx`p``=;;!xMy~k%yCT{Fq*87nUxB(FO
z&a2MNa#g@jT?07mox8t{Z2mL<-IBjN>HluYf4AhninDHE{*`T7fA!xj`TuWAo=Ztd
z<?Z*+_#ZsiZ(C)Bp63-7o~waWid$^Vy8q2<_yAtx&-l)hzdql8KkhF;j&tW&Bk|w=
z^6RUo>x09GGZmlzWlR3~$*Ye5NBU*OTWRy3IR%U`7f_Yj_dl#P1#qN~!mKwPzwyV_
zZ|jcKNdL({fA_Bo+Aaw=(iCxv|G|;|-?k+H@FcXhntFH?T)NaLQolNvV`mNmWzVR4
ziu;%eZ=7CPPd}eLww|Ze;&{9f3t8L^<FpEd#mdO3TSV=<Qe>3AJI5~fs0_%xZMyOC
z+@|ynkYBwnci`Y4ELbNJn4ATCgET%IuPb#%!$!4Il?+J-=5O5trt;4_zu2*HrgZ%Z
zXV<TA&Hl}PEw|TI0TY=!XDY9GQp)BQ%*@Q(dP?P8+xk_?9uTEHvBc3NKY}69fm+Q7
zH$kPTf7c)1E8<gOr0SY*=+Gg>Kx%SGSR2Bs(g(g@^wFOUC$w%~EWW7b`15O1Tbr4Y
zQQFT3LuI@$=y;TPct>28-PGr8%%0;pG3J!=KC7}}84U$!q2_!19gYCmB13m?$6K&p
z*O^$YJPW&UW7W!FpwmStRcTI}-h;7to*n1(OIG>cZ%^w0BndS6wTM?G*mn#&GU|xZ
zSaqwPJ%eVYRZlLd&`3lc7gbJv;4A9)!}jH?SEOa{#+5pDN5(T(?&Gg=-!ONyG&Bq|
zjMemZidUf2{M}H;jqx9v<<tx~Oqzk-USQ3l<b2*2_Ee-QDla#;7d}$V!?V8RR1H5?
z@E`tg!*B88;qF44a$p-i%!EIBsouzCk9{TOGvqYTQ@|f(72|De2Fg~QaYTx6Xy|Xn
zn;ZSL>&-e`GdDL6S)dCn&dWfmk1_(*#<F=`KPBwkCl3?G3n_)fLKt+lZ)@{tX!-pY
zZPnv$sk~TIGaHEkZ$h2$mGJ{;cZzO&PHX2DHa#!gCbXQNA^Q|#waTk>h)aVG9@V(G
z;+2(^?e^_?{D4y9-s72o?0o<_ABP^VIHxD)r1V=GhAjuA1~skd8yb4c3o)tg7NW{O
zu6}K7jC7H9-JIYtSx>?Xr2HwMW&7b3&mS9eT=}Nd_ghKaVUGddMm*YpA?E*#MGIqP
z7^MZhF-m<@Grz#E<S@!lwr6{GpHpv6rTLDD`cD^KTknYxFb<UG%hn9Zsq&l1-J*8_
z^<<TvQMXep(*RY`0iW#)EiIf`t*_rc5Hye#GJ+0V9Hof64gSpXLUZvb+&7!Lh`*Yv
ze>mN%AJ%s{)+kKh+uOV8rg7I!ao8vbm`Xs5l$Mk0*oW!Q0Mt3>hQP#Fo2t|J!9tI=
zmq!swKrh}Npd!JR+lm<&YZ{)$FvRlDqaH0yVg{U=&qcCwj4pqH4-_xZH7{PgsBfh2
zBmdil8c5eU16nBi3F1q5$I4-);oKX+r#Ds21G%Txb<^A*-4Ly1j9+6`i&zJM-tHIa
zC3x-vgKP_L2^e-6EKvOr14xfngl{(KFg5+do5uY;FyKFGET}$X6z|cAA-}~p+kn<r
z2acn!Sm?v5?AzhGU1HS+Hfn+0r}SR?0QnvzEV4g5q=(<C*eAN0+BEZ8m3u5TjF}a-
zril$19~I$dEtZ*y-P$mn|2M@uEnmaZedy2d^_fpdP0j1=?G@f8D<x}w?_T94h0f%~
zT?vVah};V8d+(1Ms^OWpdJ@s@zQk<L@&^tN`cVi30-k91A+vtFgrp=U*GBI8Ce+b^
z=b;hLErZ2Zy6Sgrx^17<Ph?DTN-o~i+dYj0oSo(E!>OCv=jZ3v%`-BsMik^u-Opfj
zD8BEw-1E+#y*mhcA}Bmom%ril#sc-`4Digbd`p7laLy72koF6*){Bu%O--kr-yXY#
z-3k;+PgWbqM{9B|{Ta9nO76Sg(syp6MYT33r|Y2d6}))_#BVOk;xIXieYmfd3w|En
zY-r&=CZ>My2d4ecP3oracddhaTv?f!g)J;Y6I^t2+s+fYbCNN40|G{~Gj1DO8J?7s
zG>$b)%O=@|>s2$#Uln3kFG)y96tCil^{$(oW~cn@YHt(^4u?xiOLsnhGh_}3qGYzF
z_9Ohov=qZ}F~J|{zcbAw&Yg7`HI0>0QZfg$D*2AU#GXyUllCj?NsNX0dBwGg`2KHW
zxMj12?U&V0Z{H!R)EPbWK1bZb$>|)xz_v&~*~my<JsHARt677}&AsF0RjB(q35Y?k
zgyNdnu+i6gz%sLzmzU4?+#laKY&kFk1W$vSPZnuFBnFJM`;R#MpI^CpcAbju^w6EN
z1Sa?e%^z3W@LmoA73ks-@xswJPS?aX+;eXE=lB0ZQnU*J;TvxAG>d*ctC^pj{AEKi
zJutWRt_T&+nbBLF9U`E4xM~EA3$1)1Co4<z4Ah+FhJNQe?9Y2*3Mh`{*o~rl7^Br8
z!iYb&5cpWWd!kX&#RVN6V`ylo>>fr=&F}LTH(H@*y_Tg2^pB@35pW87<D|+}_dVL4
zL0ZA&3x=?t_o7w9-Wdt2*B%!-BIr8)+_XR4F4#LiM#T56kMF|dBF#M(xB8G<s}`;@
zSpSCX8s+IfH=^P(%kEBisBvjRYqCA<H?0H#<w4kaC0G9cm39BOx8`~QLGq4TcI2zK
z`8A(R4Df3p<JOS76c21<L#%pR>pd&C{5`K;0`>z1hNKUN1q_%ARq-f$*uZ&3z){uQ
z(7~0QDS{R+2e8^eUE47Yw|5P(3)tVEKO0K43-_<<cWaiNI^pGjhr9%AscFLHog1&C
zRtIQPh?v!slWS`oVvDx{K?2SOI*ohfRm1!#>|3oYX?(`$-FO&twO?`#&kh|l5uygt
zT-66SH1`2Q4&fcLF}tNZV&`-g5XPxkr@i^W4rUDmPOVO%NJtDdzu2L%#|1Lkou@`G
z>+)-s#f+!;wz<w>fu!2)#>fpN<z&(BJ=(A!yl<>%8JK44<px-hHUCMZhf!`FTdFJl
z4JU9mf;~QOU?pY-c}%#QVWYOxZK~u+R@7Mj@r3&ujen-`_3?}-v5?#jWnneo=FS78
z?}nx|!tnOV$vXDx=ozy?SYn%~lGoxRSupOpLVEBmov#vVV=eKD4`)9n_hz)O4(#4L
zOZO`Osd?lJ7OfLRTU}_}`1rl6_lI@^>kl6u-0A-9Zj|a=ZSCpQ@M2WGVQwv(Z0aiE
z3v}FE00Id}%{}VVnPI-=o~%23tfxR9$@Z?l^pX5sWOlu{+8xDmu&NxzdRjtz>WlUD
zZ<{p6(213%QGedHzO3TYp(9i|1KziGN3@_u0Dg88n&fl#NuXV%X%P0~89KT4sh*oS
zP>$m7bX;gd&F+vofF8tRf<1mTu|Iu!APSrQK67i=h2(`Vdg&ASQ(Od=IgOY?F_FTo
zn3R+&qR?7x7Kt>bImlb7{c1P)sku;Skkhbo{~#4|!g=QLf7pY6nH&+llWukF=(=Vb
z<+s3Oy@t5aO^$6Yx(K9VRi0g9x%dOR1Ckuwv5EK`1Q46bX=RL?2JpF_(k#b~9eD3D
zU;{;HDeC2q0n;S&q4Vs9o3Lxm6Zl-Xh=$7k^|6uvFDi|P?x+aA2`uzR?aecrtnbA-
z%^Y6a+huP1Hy@HYJ>6pXG||grZv?Q5sq1d!?Ah@bdGQH<H{;RXz%d3JZ{Du5m;Z1}
zP0h_+N~D2L5_X|k5!?26FCT6^@B`B{R5GFD_J!jRpEH3b(e5&AHT;N2g=7>IOxOLB
zt@Fgejc@v7yY{+&diC<<V&CJ)s)@Jiz+yY<Kl)mo-F^0K{Z!{G0&%8#$=uCNdJuNj
zP|jh)O#8__fAdj=g&<egJTMIJGA9(`-6pd-!xrB?moaQ#-X0c3#}My65$KYGg;bie
zZr!@|5(pIzZF%-$;~Rc+{%^6NIh=nM=tArdXFAK|IDFC68{T7i6*A&|p}^SKIFR>;
zPP^|vYXSPw9UL5XGtLB(k8gai*WFVGn1k5XxX4ApACzZkrk##XBwJl?nBVdaB)N<1
zgl39=fejN>&ukbrofO`F`g9FzYbYBpL@u4w6c)2vvFHW6Kz5G!d~%>3m)LNB-^c;Q
zK(I{XBSV|^Z9NwQq<8$iyY9=4cLGSyp92Kb{?c8)!yDUn0B(l>l9=IKczlz|uK*qK
z4j3dG^<BHeaAPF_x@pFN$(pfgl}?!(i!%^9*q;U>fOCg+R5lMz^?=|sWHjl`hF*U?
z`gr;RP_B2kk8Dz#0o>t#H{_Q%@V^`K|ILOx;Ii<J#E}ul{DS<KX?GP&HdBo)+m)|H
zRP<T`=34rkygaJv(<dJrA%x18!cK|Jzw_zZ$%cKGG&PMb0+{10v*Y)%*X#3bf4P^x
zzdh-({Q(gE>|)e8RgItD(3AjLc~ucmV!gTx3c8zI=C_C<pnX#SG4ZK%Qzh;IA_MV#
zr7g!cRpMHGK#2>oU$t$j#M(~)C01;?<glTsTo1u^$pBWZC`nH3*Y@6j8My=d0ISyV
zd-MOWDFuL4t8=RwzwqA;`CC|f^1mDMp9=Kf4fzG`{GYZVG9~I@6O;V;mp&@r>Yr{0
z458=ZmYvK~nsT;MQr|_e0{sX6^NIfJex5hYhLPh-;mOHkPT|e6Rj#uiwuoHWy?&w?
zHDv4tk6?U4;ri~~-XY7y$6G_(su&fiI4(2loL%Ws57?#Me&-ZhJgftO!kdoyyShq|
zA1t(%4U~gjU$s^%=g~i3+-du}SIZ;E%p8)-(2%i^%a<_&6&KbY9Htq=b|Bdg|29Q&
zH8Xr1#gh$8jJZ5|Gc|a%;;rK0ZY7m|ACxV0$cEIwq<A8CGO$v)%!*BtNe5hBTs3>f
z8Zy!}#`EU1#?TCE^~9>X9QCu;XsP@J?w0AAR{B!?HvQZB?HzT-UT+r$qr@_UQMiF&
z_x+O?OkvepD3&wRST(vz5y5)R9_09wr7~1@{cyKCc6szO4M+!nB|`}VZYg0a=9uxi
zSRs!`3|~UhhmU&VJuc~!YW8%p^?Ig*huR^arVV5rbfQh8!~&Cie0>K905-30(b?Eh
z95}TebBa+ZzP%70*01#_&tvvYfqadY{qUVswZR}B8pu5f|33ayjk4!l4UZFxSDYDM
z;Lv-PIsxZ#oojA?Y@-Vwlz24YPnuX6OD8E1u4Kq!`b+LPu$M@7N}<b-_8q^ZZDH-L
zQ(73!jNi>jK1g+T%AVpz<;Y}Lk$L?!tS_NRYc!e1a(H%PhUe>l`*i?0%pJxaFy^Ks
z?<FHJG|o33kd&a?WGou8Qp-tyaM_Te`LJ(4ZV*4-0GpecjX#MM90%m0aBi9!Oi`K~
z@XZNHA6u<urv~(bSTxuZo|+8FmwYb~7}(&`m-6`W>5<VDeHEg=-(;`t+}zwLHcLuU
z(t;Mss@p*;+10mi(&d}}0Xl}@r8fHq)=@rky7WP~@y(l$oWmCeVngP#NY*cMGj<Ae
z|2VV1L!ALD03L0|<J#+~-jkL~<2aamK=D^k%G%MRNAnySnIdKOS?Of7XU6>e%N=8v
zPo1KsnvxERhyVxQsJpe2PaG9WtT2s>k6TYcS5#C8vZ^bE$iBWSL`)TAoBwosVP&GP
z=3iW;_VcSoMln0~9y`hZ(=MFjzckU6bL$MaCaAc&ZEJY7oVt4TEs}SfF_0euhI>>8
zcq#{Z71l77u>j*UGiFom*SXlpaGUL0=l=Ygj!!i&T6_0ZPKLMRM66A#J=(Sf(sD%u
zdmF;3$&m2e^@)=_R+o|HwMKE3Oez#8DHSDS5OcNmGrsX0ky1@otxVMdRnJBpO+dJh
zV6hd;Gwk%GW>on3bGqvsSRa4H=R3ZA^KjtI6Ze6jW-OPRdMPX+V5T^O%?_Y=WGyb5
z5p9FD#%H-RRYzqk)G4Xe5R@#Yx1jB!)w@+rtkx8U#%*sRx)ag9dY<T!QF2%{a?ReG
z&W~gO+(bqghi*(_?H46aWK}|3zIQ_U^Zbc5Kn|L*xPZdDw<ev)ItzZ6l;vfk?heel
zJbxx*l)7b~#;%Aq|5VnuZ5XdRpj=g+OJCYPo9Y0Q08n;yi@wT0D1{T^OWpgm_r6N)
zMQ$1YL;2K#?#}dZ*{*kUW0PN?kN{s38ylqk8Dr8G_DnX1HDDmBUT*r}!DIEtGzE6S
z(ge}w{rlr0A9F;gpUUm%3Le~oG7y~r4Gyl{FM36nS2@931P;<!(K7Jg_kd&*GP$55
zG9zn0mYtnBo;4<B@dGbU1#BX;;F*~Jy9GCTo#vUwXiZa7u}Yg{NKY9@$*S78?AN)C
zzikbVz3RIy^fCL#*o#@s+jVU6i02N`up&9N@CR69ZMqt-oZQE5_#6(wU55ouOcbKk
z*vy}wW9;?B3;X0-7BI(;QNhcrwJ8?<jT*QQc;>~hes5vlwcq>p{A7!z<i97h<Y6Fz
z{UPwx#hJTjYEX<}-?kH|&k&W~V1A+SJoiF;mz})UtQG$c)Ea4>1RWDLY)fTjdtqTF
zPtrepp4F6>w@b7MF1^r=WK?i^5M=<dX1HnwGB?lr^r<tIz4A$-YWgL3@ux!U%C>u8
zxajR~UdcS})X!2hkXY;oW_gLoSRlO-l`1_4j{&p2c+0-;tNiK14NF}F{KW7JAy=lU
zK$XzR0LzoywG@k`-X|E(0=XV&Iynq&?4ch-!w}l`wH2%Oj(v;y-sMy&WR4jaW>3Du
z+7(020|n0IhUIOl3uiI!OR-m~*to_4r#3yY4m>dxu&$}^ME;fj`iC_<0NQG}Z+7?0
z4Fx1%UxlfO2?>+WPYtaZf4RnCc9<uoTQE%T0#hl?mjn~Y_Se`I9d$N;UJmLFI(k&7
zI^7OB!Y6lSF$NeLh*qI?0o+~J57VGIKIif0Hw5;$20>Ip-6pYIILCHZ{~bM#qYI_R
zh9)K^aq6BEoe=*vJ`3g5-2kfxsb09&`kt-(gw(&1jv!WBuyiR%SncD;|A)Kx3~I9L
z+J<fDrBShhihv#IA_4+ZtSAUb@1Rs6K%|!tA|j$9pwg5U5$U}ofi$E`?=>U=5kgBs
z3jspNdvZPZJ@d_@zQ4X-?>K{_j{DqY?Y-At$FYuOGgYI-Eij=zB#v6_K-mWOmw7R(
z9K<d6o`eRJ)K3zQcNP&A3dupUJ7Fcu7H(y2e5G+C=c83L6E-N3=Iaw^;0>eicrW)-
z@^#IoroD-(;{pE$kdXjFYpALD))=VpWZi#3M8rj%yVJY%eQj(ioxQsnh;3(@SVJ{H
zs$5&E%6L=Ok_7~3nWE&IE%OeDN0OGl+rw5DsG3^Z{fEN^^U;*G`zV<bfT+AEO||kz
zx>t^QvfRQoL^_@&-6JaS4cj|aCMa~Y1`nw~S7eEeW3da3*jb7EP4CTf1AD+74Ns-R
zQ~@<6asb0XFlbbD%Y`V6?ZxqDRs^{Jp#5xtJi8cZ4dYk=&{hVD=&N<$#;<J$gs!Q}
zM`1Qx&rg3(2UJVlVbC>c=ciG$Z(D)!uk~6E6Gc0C*&9gbq=Kam>nc4|+<7qxiIK<Y
zG$JFQF0Oa2@ubLFQZeL)rEk49W}Uk^O=#-+)G|08-Gv(<_Y)aG`CD4h>G`?jD^Y4a
zSG>=kJ?rfE*zft<9WP$Kj(z*-%wyX}w%hjY+ovi1<&4;5$M-LHs?~4aIV?Jz7)1$G
zNS$3C5uGHDVFwa<MxeHc4%J%Wjv*?EMzksrm#+HWhGW2WA$V>V)f`QimUHfYgl5hB
zBtI;1<UKao&V956Rf`!(Q0YBnlJaq)#nFIG9{b<wG93C5qwc<4wHlUs-D_mEn3tj5
zSVMZ(1}esPP+R?*;ue1lzRh!u;@=&}neJW)By}TUsL&J{T-DD~P*C;88<ErL)YQPb
zxai7CYIPW-?N?kvs(xc34A!^|kQ$hfh>qchkHLILYy#HS093gj%7D*+xU>@toZJJD
z>PBl^ddVrOb=hdg%nOS$9xqALhk#C=s@lq@%v|$~j|}Z?5Q+uV*LQoNoVcL<#g{nW
z6|=0|2jj2I%l!i|OBt~FD^p{K&2h`h6xFPhz!$_u%`wweoKuGoD}|p7y=a3IoU3lk
z$vVvt@*RA)QDA|_KI7!1@vb^zs1qjFu#f%5OthA#j&@)?kRKnEQGz-myLum_FAu!Z
zc6WQhrqeSnMV^{sscn8dUR!c#xMo3_9$>mMU#EGbFWb7FC(o_{pBYegsiIJYy&)b*
zB}My8PK(UW<Vp3@@$73W^-V5bq&RvI)|b}B6bzguD?^)u$bsygtd%;jv|9T4+5Yxr
z<L`F2?^Pc1Q?DYHJ9VhyRiOk>j|!_?wj%x9dF0b3PgZ}!%aU3vH+WK*>TH`Ivk_3_
zB4Yz{g4V7Uy2iA%OIx7ciSKn7zv8}ejO1sc%U@2cP?L3eaqirCACg?cOod(I?5~(8
zBOP}=y$_{kOkc)u(nV_db!~C@#$AKVj;<eRyffd9MmKd!+pP&n<KPqZS=|SaaR3qA
ziq}Lw>v9bg8v50(k?6BxCgK#>GZ~{>)&2f(hq&9x{OO{OzAaN%$c*%vz?WhXHxhQr
zc;uR}{y~C!G&SU|>yI5Clft1X6H$VNJ`Q<vs-|pqAYPTmbNBAOX^cSN%%WC@pPB`C
zXj1d(5LbgI!0Uo^m744CVTN$)GuUm2QNpvv7xQG@4)uKux9uZ)k7i}%C8%V>g{^#>
z0*0)$8|KL`Nd2_HRTOtV#d-Z#k2Ea9UWzb(nu(dXhh%g&q9gh1%r6u3I@BptI}Md-
z3)9{mHRWYYCv9Qst-%9uh-XOEz$+CGcxJtUY(Ea&eWrhN%?XML_P_YzYW%^{(aol6
z4oMYo9$hFIMbfX)^+9gNWju6#tFGz+UUpD#PblnWdYjAUDjY;&S^FbAGJ}hRQoQZ3
z;0>IYCq)7~zlkF7X1kMy14lPQ?H;FP$9+91WB)!W4bI?1W3Q-;D{b?onOJ(oSo_oW
zQfhaBFtV>$5&ZD1&jzVLcB#_Fw1;~p+u*iPCl;jI6>&6knp9b&Bmmjp5GnL^vh7p`
zHXA5qirL0WRfbL_#wTDHzCdkblpv(-Dh@q7O_s|lsOHYZnyou9&HaMG6e;daj_`?(
zg=CD%g~8GZVf2quG(9wKPiZ)xbxRX%*+AEOjN{QL-}5~fjkUt9vuQ+>H}Brk#g^-D
zD+|mXeHz2B`MFZev3`s`t}1t!gm7-`pG}f<g&NHkYGR{aamYl0<13DlYEr1@g*+VV
zdAf@CG@Ma@nOOvpa)7dDMc`pyKi()Q{M2c`q705IOF32Yx47Du3;);yNM538GU}N|
z{FVv)JjlQwx$NPwcbYE=NhkWrS_>3RO|?P}`6ndE;Di?kIa1HjXUK_RAwWU<66p$|
zXB4+REyebS0S%Zb3zh5s-*nwOIWWT+%ExQ+%7Ha?Ckc#(8%v)+nxG?OVl{54dxgcv
zjaMoSb0zwzp7?HF7HsLe0O!4e8=6S{(5A$C;Rr#zi<oyjPA2BBmqX6@H!4rRoOB`Q
zm$a*}mv{7i>=47Tgsz(I{XC3}dPdUL*6#Y~AU@*iFYa`8wTWu!EC4EW6MXKd&HHL*
z^A$_kZ*Ea#u9)N49%w<4u%>Iy2C+E07|7_+#Fd$+=rarxibPLsv`WDmM8~ia-ZJC=
zYUN%SPpv$Nll_VrH2#Fw&YeEe5ZBgZs!T%6Z?*-1mTMwnNW|^dY;f&8ep{k#A&{fh
zo^%wJ5$x%O#Y|kJTVn{!<1RhxVib>pSe>QJ$Ua)8Z*VwEmh5kFK3p)Ua}@dV<ptKg
zJ5OG*$S($04z=>Jk!L6tEoVqg7gd;ZTEk^dMdCSjv*xBYnL4F1`C~%n4t{C@Qv5dl
zz8D36oJU#sMbshWz#KQm%RE`i;xdsgz)nH$c_ME|2?o?14*y=-Op~BKyp2+bvc?Cl
z|BBHyEU~Ts2ww;v-N(zGCu^21S0cfeX1K8RxXD(lQ8uokmYq!J$<u~x_tcThn<qOe
z>3-hKB(~kEP?*F~lX6tOnnC*x>}|S=>u~G$7!LN2=;FJEgU@$mSr)stHMH(<w77xl
zAn~s0I63I%Cr1ugCn;&gWC`L_!3c>@W6kZRqI^XvEA#k50%o8TICeaSEZC}}(9REW
zWnuAX=3H`-{#i3XhRK2_!8$0l{W`7AJIl4ZBE)qC!_y~jyqW*Gj0zq?i^IVDs{-W4
z`UbWmleoA070WnvVj(TvD(5&Th((XkE3#0U$`!vV{n2H@Gyh>U|1vZM`5s4NN-hbK
zp=tA>JJ&P4kQlmgsOmUzm#;N^B;O{*9oMc9GqTd6>#xQxU|r)NWu_Y%nkOy$bG_1D
zu}*@?)Mco9gaT3E<dS36S2HiNPsHdjLo?V4Ae__;9;R1^49ry{;)tcgtp5CWJ;?ze
zOVLa05x(k7SDh&C#iie1u#5M;gXU>3{-J~XOt;n}sXpaH-wVaOA{tU1$db*Rwes`!
zWB&9412baX>BJt+w+7AR_bGjS1-d93pSR$c(~-grX?O>dLmOZiZvBvyVL8x^rOlGF
z9cwOt_&SF%+Ybm;u-NM#N{)4i7q#~;4^Y<#=p&MVFtQJa7NH@GYvif6ZUNLx7${fL
zBz+Hr&)b+^ZFyn4((F5~;~O^5g*D9|_Ljx{4f!`Y=N))Yc!D8SOKEv$xz!sv?mgm#
z)8`n~Z#c?%rHYDxo=ArkOC>juIh*T~*V6kXnB-b(%1{k>I+{}Ynb;37MSa%#Qb30C
zjd@mT3mG5G$m77seCZ=2p1h2sSJxbtrQ3PHUKswln>|cHcOPDJz<e|m{G4Z@qaTI&
zrE$7!sO@Y>xht&9;>Hkp^*#~D^Q}y5HioFu%KB4CWg0-ixsuf%7aIO42Xu-w2h>WV
zW*x)!O&FHlld~!CguBn=*RWStL(e)i_*%`1`%v8!oCE*^$wec0UNWQdlN=P<RcDWx
zAXLU%+4(Q%b3ig%NZCFHewavp!<g%7le{&9EN2hSEr=e~a0aTtOamoY1oi*|;NT&^
zidk${<J3SO7^oAkBx$~w61*OOgiw-{kUkD3i^HXP0SunS{zg!{vX(EsuZmL`(GE$Y
zDf?C~l<YbA;6YO<+o#=vF<qe0ATB1Rsp5{e5jjn<M01p70|8e{wh!2Zlbj4m<;u@X
zz6ZraZ5<49jSG?|CYX5E;USK9V}TWk;~dc;wK`h11LzHg=fKQ>Ue-#1QI)k|ffXyf
zruN*303Xm%#Y!{hoRJzR_WQeFRJQvtU-lTD*+stonbj^rmrN{oh*})~8OB;+dx4|d
zl{PEVnSf8;LLM$*N;D^ki(}C`YP36d6Qm~i?gfv2IP9+dqTIoEab3B3<xi_}1jyTZ
z$&yx4d#Igst(B#c1Qb)=Be2?e#Y98JP2g%pm3gv{3u+A3;3+p?3Hu!A$H<=Qo(9t`
zat?}n*t!iAs$dAWr76x=`xDX9i-0J#s{GDD#~l`B&sYF)_0dpiSK$qv;gc)I#y^@t
z4uI{FuNId|XedDDUU0_FH##qLGe#D0JYX6F9Bh%*94DTmU%yBI53hH~`%HO;GZH1H
zR``b6TGRuW6KcT_O!uq0Nd>R|AnhQU4`oc^4s5ehq};j3SY^GgjDWr<@t83(7MS9(
zUVTK_y4Y=dVO&_QWsYs(7-zO@a(1?!g1IU#9~wA%yVhq^{aqfl3PyG3-|dH;-i=;$
zZa_IN8LP;6m*;Qd<??DFv!L?p<FVcjUN{9A99XC7G0nBWy3Dv1ar&3?hA`Z{vnRa)
zd*p$&tX)|<z&~#)xV7dfg#*SDXcaKTL$J$~Op1xKAp*RVXu#X|hnz*J9MU9GQ$Nl9
zmkW?T@?K@x-*L58Y3-XG%*H{XfxMfq0$%mg37zdZ>}Y41;dyZ=R1}`X`ZD(wWL{AZ
z#>a2%Jv3z?L8Q&Q3cLbUE#}e+4HG!*cBoJv1D@}fRl+XoGfJ3xC10>XlOq0!UuF;J
z&%!^2vrba36tnA+3X-gbPUp>%3Jrv9U_lIW>HJ7@#_88@3~X<`XpVj3Tjo^|AcyWD
zhod?Rk^HI9k+}XQU4Mui+l{YyK*ID!sk@}j>p57e@Aj^8*+s8)L^Y7hd#tJ6g#3wq
zdWDyf7Q(8B`LXo##HFQ{xvp~|p_1J$kSl|sZ_3@Mg(R_~R>N(mj=_8ibY;$<{_Vt)
zC49s&6+!xW&BV7p&uX)a%jdGZ6tldNY|^b_e;;ZMRX%g>oF(A&hs``Lo42$5X;^4!
z78WiXbSBoKrAZPEqp@GCu6b?z9KKW~g+i!|mhL%oa(0M8tg_LJ6A(W2TkH{lEXM%I
zQg{+Dbj*VMPS{+w2#FMD<qx6Yv7<*-WY;H7Gj4&X)V9P?;w9SGGH1UakJdwS;Ni<Q
zfQD5)dYMj53Q08zZ@<B@KLE9T&d6h!Y<z?6x$$8Z@*a4wfxb_chg!|%jcerUXN2-z
zcu_eN8ZWOv&ZJvGI{PH0JrZnhu6Ws5_a{&!21XPbsB2HuuRuHf{)nHxy**mIpMhm!
zbm4_uVgMWan1&lFsyLZ-k_Zs>$1Uo5EvDqMLRwG6TbO~wAs<R$%(km48-qQBXpp(Q
z2o{VQDhHlO^?pL)MYgg71rx`}M4;N`LS$;N`>o8AQ{*{TgZ8NzGC?J%5mj$%<3BAY
z$@X=?v<PyR9}B`Qm%M>obkh6`lGxzv)PnG@kqM;dXaqGDn^lcB==K3olGLUW4YWXC
z8maGd|DG$9C%Tc^1Acj3csr^)C3KrKE;=%@$BMHX4Ae3HT-c}MKhxBhXTs8P8OaXz
z*f_}Fr05opU;FeRr#qwEcA}$n&#~LPSv@iu3ZfsqJRkjWP7bZ=ZcR$%_I)Og8>6g-
zOMQ~goj-3>=4ccrp5!&XKd%YzMRkvpw$VXGWv4ncC2TBrI=+LDOSOSFtZ`dnpCM9n
z;<VFiVrWDG*VPX>1Qyn-E&3>IEY?`aQh%6#uBMi>qtHyHw@H_~(@hwfH%2uA$9_!w
z=`tzYSDZ?@2;M<6pW^+4Wo_G0eF;FaUC-Zx{}svB!~r<<8(~|izoAU(X9fX`In=Fg
zO8SqV0FHL`H$Zlg^up~{p1;E3yOMy<6i1%m{5fwQK)5b10C391;MbMvf1YK4e)IS!
zfZU@Fr&s;yI{EkSE?NUI`Z``2{=X(m9dZReQ!Q`1{5Ksi^)Gcm!DFCE?BtHWPTC7?
z0Kpl&_ippA<BjzP!2Kg?b(UxTI%&mQnP0@$T{eFm?-6Nrf197-pFn@-5Ns)PJr<Bz
z|NU|QpE-K;6L5aCHV%1({B_d)e=-uyhyGPhn-(9JW&M49?w)xDB>Wt!*5jp})dHA*
zPlvAmwV3m^9e06jG8=Ey>EA04|Mw{y60|oqdtOyeuJ5crd{XOW%76diH^}sb&KZEL
z#~fnIPD!1)9j<l9AMymxiuw5QCmUMKdyw-tt*S#mtiJDnviBZ1-~$g-t7M$4u-FCj
zXN0XZH8p8!YJTK6tC6W8TDl#7{qjDsQ6A=#Cr?Td^YhPGPQ`mxZwivL4$zMtJsO8`
zjQr}@VLZd4Xzkt0Bj~mA*KYi?JLJdxuw?I#KZ!_#`!Sc^zJC4B`Zl$xTBvwT%=`CW
zV*B!ruYKRSZ?^kx8Z|{EPVD%8^fB094d-&Ux@EFHpOoQZZ;s{(CBroBBrza=&E#Iz
zmvHGQPN*slt*;0~WW?lLKi!H}F-}XcGCm!Z{8xJ2mrp$Us_XYf)i~cOZiXH^etbf6
zYS-)z6fjg`J`^aDW@mRCHXixbf6c*hgnvnTPuAZ?`d0gll+GI!sF>sA!#F9cVc<FO
z+U*MJ3ooOfAJ8gv7)BY@2|#v@pXhY@>&Cft<i0D#de3C5#~8kkAcB*=Fo-+d;7GRc
z7e0D4y_7b5m`vq~cKgfz4moo9@fc@wsO-3)ptiq_<@hYbA92Iut3JW>a(&}*6O+(c
zoL<JUz|DYtvt*Tub#2I>8yYR%O1gY*@f|Tw=3xoLj%~vqAV>}VtlG6&t>C`=M?gHJ
z7APLCy6qkXF|WFiS=d_9!7#lWr(YM_v_?we{KdvXZc71P)sH4wL}$@F0mj}o<vi~j
za`$<t-`v!n#TCNSf#Z1FJEbvL7w-<>hk)1aKTqc68^8fmQ`XA*0Ay%rQ&~|jS-}P+
zXa9Vt?Rvh|>i(?;{~vCZXD{RE(U@zn&G1~kjE{x5FLzN?%hI1t9HeuZj@sCXzC74V
z3XHv)mobd@D}u0_kBiUz<jY#e!@od2#U|$$cOD9R`Eqxl$+Ykvr*ZpMiH2>rJphV4
zu$ae#>6Kh7k6SN3D!4xSncdahFG*ke(UpEY@Xq9@;&e|(?6ozyxWpSnZu|oimqb<D
z{qj4P+6{gQ`q}4vz79p58%DM)Vq>eg#@)DpA-cc-z@`3VI;tmj-=8~CdOYw~<z5VO
zoasWD`RK~Nx{)Ee{%p)vWrW3N<sHu*gQ7Qer#d2&V2vsmy`7OT96Y3O4IzkKUKr5w
zS?tp8#p#9a5ERc!VbRsTglU=BS3a25*Q1}U3loG43^uZ-r|uny$QKR?9%WUT0`YM7
zujg}(7V`3%nnX)sIOCEavp$utftlgAY^1q2u`6?0eyx{)u)%}c^UPTWfOpH^6cHv~
z>rpHtb~JdktfZK&EWDhIG!zrl*D}s;UWT=RI)0A5vpL^#@Aup7ITyI;H!Y42#fOXG
zqEE}-8xu)>zow+Ge~g$Ot`Fy0Wl-QYXS=#SqaK(OEcb>A8!Rg?k^E!^EYH)1#)(q-
zFz8)UFf{(&ULZ^Bhp~y%n$-*eruj)pjtH}p!rma=ez9@z*3BCB9z?Jnz;{TWd?%PG
z7AIy;4BL3c;<{3D>b}_*5R1E1E?j;$AKb-Kn-2Lf-karRfyB>z-6);FP$u1!uX*%W
zLv07>_;ot953@SgGg2iU8)-}_r14_sRYgS~93_7$A}U)kmcT<CYn5PK=@d`bGD~f@
z(ACvlR$Vmr6j<|K;2on0hiq!(^>3!h>M9v?0=*YW;V_|-Id#7-2%6<(GAgKu;E(Mp
zv^#huww2q4Q<Bh3kL1?8LRwIQ=A1?wclKQhCp*z7FT45!as<ejT(ulRG6j?xfQMm-
za797ht=n4dNyle5hqLA2uARrJi0J|Ul0Q)99~}dx{cc)fqn%LhysB;MiMz?qUVKEk
zc5POA9Usd7{8bv)$&~jPyLC}@qZshVt#EfdTH@CVFU(O9#|Rz<g<~)m+poS=*EZEc
zV(stdn`iuzZGVO^s#tRry=GVv!6!PFVDrt5XqaoM$WL}cLV7JA6MC|<ZA$`V#voF|
zjlJJ9ZMt~VOfC67kgr-6rST4t%S$kgrL{sK*g2`EObqZV?Jy9LRTN}|O7ns1Rz-n7
zR5IHTH%-@O%}JcqvUS&n3hyMg@)F?-?1wY=cEB8BAirm-3G%e&{Y}+9Q0&hTqPy|<
zD<2qQqE`gKcieuR&oyB`zETxD&c{;Eya_-Niv%)V7Bp56YmgVw-hS;)Wf*ISMirb&
z713xC+Eq@N3!;=HaF_F--<QdCPMpe%8<_r)gNB_YW#d#Px%jHto`ZF{1Ca%?KGNt-
z`wdkz%?le$`0d&ZsWsWUF&Z`>g|ptMZG5Rvg~i4u=IZOJrFT1}rp2ZxANM2q5av}K
z=dNF@Qtin)%6H_PQT8XOzpy|aC&4OSr*8%6WhTz5;)-6ls=w#e0fWUCJV10;?@su^
zJ+<uo70GWyxU~ZeC+XEY<C*x3MmjxbNk>hT<YT6;YPY#(xOh!C#do6%U}$x}H3DA+
zWO_mHh7De3Z4ub0BuFvEYi404xE4@Sc1}_Q5+f^O9IMhHz$1_rXxWqATgE{u<ys4}
zAhQgh1lPAni_I=n3YMhkVw^Xp+?E|q*E2Ny#`be>Y@RK;r!xjaqY9S$7UPC19Fp2q
zC;WXX*00LtL!aG4^ZRmF8h7^<!Cunm`mIF-Nf&yi)z&@VxH|f~xa2xYt|Fuq*@h%9
zt;W+Vity1qsz^t-38m1`{?1D!Yp<N8$|@5lqdZGJE4E5u*6tM}T4LYGS}+HOPffX2
z%a4OlDlIy+6Q{|zD=kt3Rynf(VC=>wVh$v(udqwiv9^_^N(-MZVHR;^*G6+n-oA-6
zD3~$wv8N@{)1rCCe02mOa=g?!`Lzgs5OY(}6sdxuR>R>-Ky<wfV>jQEczxrh+>KIS
z^>7wx&wf2DfOiTog6EoV2~zSutTX4nVKjQ51tX-_+Bw#P6&4S^L=9MuB~7c&^nF%Z
zn96LQUaD^)F=9DU_$v;m_(IDJ5|mZhZHV@BP8T~aUI7j0%`2KMKN{6P$J)$#S$79X
zSPnv7U%QUK;)4<}fu8>rFJE9dODSo0ccpClrzsnIPwTr|7Ga9Rl&qk4qgbD<W>XX>
zUx2_$5u$&iaG>!<4j#&Dk5OA^PTdbk!)-R!{1)Xq-2fZ~+pnyKE8%q4$M#%Yrp*@K
z_~zvlM<43pp_Z6fj)52k@(}&z$xxqp1LGpSZY^oe3GrX2$l@38J`mr`3rW2mSgz0A
z=*hBNACI>37gn%+sm~|z48hi<|0;#td?i*j#?fXS=#L^n<yaYqr8bzuM1(|d_JblU
zJk{f;%rM3+tH>QToXA>ITk8(1>d)WRtfuUTDek^ClMt@<Wxn_dMaBy#ZdPT@d(ew$
zamYn(f>!+;c`{vS;Ba4_OM|ko^H8(V`Vyl}YP9@0#<y*T;I*Ft$ATCfMPqBc*FJ{i
z55m&qipwMFKibKhsE-EvmWm02SXMTT7CI8RgCBYQt}qN~=*1V5i?%);FZwH))y02`
zGb~Ve;b8)}$gu5{k>&lQo=y4C^%&`d89H4d*U<jurS?FLmSEEi(T*E4nl+aFOr4Ar
zlKa5pGNPMfW!onL=fj7>3)%y-h286I79_u(R9I^mhi@>|Z~cvn*Tmh@GlRHj@bG<M
zSf!~Knfp-sMt_G&@>PgHw31w&^H6lvR1?3o5AUAlxX6A8-2G7~25DG%Yt4HE2m+%%
z#En)`<5w`h=41io(ekkmO5=5QFt#u$o6sC583P_lo?BTu7)xq}iYLi#Y^oBL;-m#q
zCNTR}8p6UB{d{J>Xil_LE^5lt$pqsVcn9HxoSUhxmdWN^LqA)kY>0#Ef2kr-xiKPZ
zgw*G`d+$|?(5InO2Yney<BD0Sqy1^CFb-u#=4rOn^`&E^k<1JfZ7^fA7U9QhNoSDi
zIfNm`lks(*zOq`RVw4+GEN*%3+h^bgG$#Qxj@R>7XhZNbjqKLKzV<#mM^1^enr>9!
z$-_KxU80Bcgctnu51vBRmZzY3e9X80BpF&A;BxDQtu+2xOCn3u0xd>=C9nZv$X>5M
zc;ZWMeFO|Kd4f#cGQKlvV;pHP_t{uMSec)<^Q<yn@=~C7QLwu&Gu@Bb$>WqPAyB&~
zHMlEm+S(sdMku0tAc%|%kv$dfyNB)4ZGgKee5K0DDP`GaD$&B9;x{krZp@&i5Gzi$
z_2a_-5iBGa;vu;90ga>-H6J>AD88+!rDVgWLlnp88Z-C7OnUlV#_m?;X7$)~Zg624
z1CzL{uILe34WNT?!AJP|9Xla>2j1vCDqxJWvG=^yb($4ihb=52?iFut<sC)bBnk(6
zq!j|gz#K^Gg?*0+Tn|xp2q{FSjaz$#l(f|aPkml^8yVq6N2%uzs9G%-Si@Q4TTy97
ze?D6aFMO&Hi}mTupr#g1>1UMwY7@nwkK8DbQq^!Ptmq75u@9bpRB&n!<#cg>-fggg
zxEi`taq9{c$(kn%nFh28seZ$=a2=AJgn}L)Oxi>S{X8S2>&1hP%6SqP%c27zeyC5&
za}hcE!lqO*dOn!gZWXxjX8Y%$IaUYxyFaU^Xt|M+G*S!1^#DxBk=G>3ZTLGr<q2)P
zD1L_Nr`lh4m{$y40(0-)A15kE6Hl_Ma#AEY`4$KkRgS2fm^b%jX~ger5C7dH)cLlK
zu4fj<ocx8!+~B(?mz-D*`}ja<20-wg-()MzH;L$o1hL%X%(4ANz;JfB3M|_cFiP``
zAIQk4P9)c`M^+?%Jem*z_zr@=ZI{uYrg+8bIyl2diNekn&-;K{@oV4#<F63cVT&@_
zFcPIWAWz)c3rd~sqvvV`A*euTbpKKdmOOz%^0;YnEY=-u9=-$JmF@op7(mDD{}_TW
zb6!O$Ex^w2vh;N%Q0IAo3Z7IJo*uk39U7RV?RGX`*l~=*uT?eR#Y>{G{cBo*HvoLt
zqmA^nh;N&M^2}&xj0$@t&xgS-JHV*o1|Wq3eR05ja7cDOr{wdx?_!CzgTwQ=vDSBJ
zHE-TWQTax-c$LQkpA7sVu;M-c7*O$y=F2`$eR41;=V<|5MolS*L34W^p+rhM%W?O*
z_+$r=r^_=eZ%lUe0+FPr0bHfJwLCz03T`88X_6kCa(-lI0smHrRr?eM0GgYKt<a(Z
zN`;v`c?ETgqlC1d)f?Q=t$P4h%TI=1W%7iD30huf6*eOJGN{RP=(8o}qVTog28+bS
z)=|qwc{_hZ56qF3V>O$tLGRn!c4}=siNqOWFpmBSj@Vja-eV^I!k)iAh{*-xZhcLU
zD|b&hg7INPs)tL)W7iw1ORp4~wL#UICo2|}6NHnW(1_BJ9#La3DK?*dHUK+W_y=-m
zJB{$37x7AqW8PUSHBRjL@th8}CdD352jRoSohWf+qGVAK7Ri&WR(1v8whz%BKXr4k
zJ9nNdK4yn7Yhw#o2qurY0`(|++JjaIEnADr@~a*$ALEQf^I<&2mPBsQKvreS2*A05
zl55P1@XRr)A{|mzM7#OjfhuHqWoTyBqRl@k0OIgUiq@?_vN&w)`*a=0Yw6EuJBGOS
z^Q_76B`lu+e~|*2eW#3nLl+V$P*_yOK1=+}a*lrDGZ-EPHIkIR(a4l>YmvgifxX3S
z74MOA8o6RJtI}Bu1)9O4eBf^05F^}Dv+O!_iI220f4}Vn^JNr3+%i!Wb@PYt=FCMN
zDLQaUQAaM<xZ6qr?FVtjUGa(99Im)%<&W?!vF9fvps&oW{GZ7HR}0MD4m<|)p6(_n
z?DNESc$&v5j&sHe6oK_R{`-1;9~0kt8Qa0LfwI_Ih{V`mE*(%e#%T3E?pztSdGf-=
zN;h2m>Kaw^lybYtlJ%Q6?qiR@4{U;SfZ!PEYgxbk_|NW~25T5H_Wh`83y?*x^Pe?@
zW1d!~`Uihq_r+JE)pPuULF0v(2_cp)1XU0@_WZCN=~k)r&}s2Ko}>a6mUiie;{8a0
zex}t6H{rx5GS+!XWO~$|k$0PDk#`SGcqzW+o}#FErv_CA9|_RMMr~-1WGOg;=I9!r
z7+*zS+si<^5_6*b)V?MaR%s4cdKT8)sx4pXIG}`@*8A+3?sS|C*>r+Nv8z@lq2`<8
zMKhGV^sicR{VxZom5ZW$WMWMYix+;=2W(^lWSo<}W}OGHk9eB0r9T3QFQo1a&vh?2
zg{gECM{g^LbIP$Sc>zi`*<4IY6g0BY18~_cbLgX`$%tBJ$BGq(Hg-5s*7sA=$yAgX
zynqf(N$hjj&Z+IteuP)j$kwIGPotJ<prA6aao$(B?_6&UKz1EUU<djx@^k}TsXd+a
zgf54L=SxJ!wV7dqL+ON!PzLt({69t#HvM6nz<KYM41jz|$JHjLHF}r|<37U)d{2o2
zye!|@?B=)@@JO!$(vQ16@^r6B1cCcNmvH4l4+7eny5FVQg5gZpu=$o0fRMqVnL_5t
zK{$(1)&Pau%Q<h|DHAC$DGq?&u5M%04t{tMRfs?=@cBT5#T)q}NSu;@Szk%clQ@8B
z2Nbyc-$(qf3tP6tYCH>KXhiDQJrLpe)r*R14xx3SnGcPA&6(}nySJ%y5>I<y9#nZm
z2xi#DAS6AIn8q?<mze`%Ovbs2lM1gZ=R8F>AAezh7~uzvn!|-L9k+-mCYbVKzmYW{
zGwtK{#K1zmhwp3aU~1wOZ3cWZl0E3?0~yAU`aIF`zSZWSM_B;lW=8<1TcBU%RuyLr
z9c)vjcl6c4=4-@}TYW}=djYUZzGlZYCzw$CO)AC%nZq=O@zse{$4I2xfV)Yc{m3{A
zt3Cvl&m-=z2lI8C<6+{;-K<RCLhB&wsEHyh;35kP$XBjU8p}62KC-X@deRqnq}1{3
z8W5my@&vBcg|~=q$@rN{dvulLYxe4=H-&d1kth?Zd_~YE6#!Hpwu1~NpORihy1#R;
zn6Yg$pI5U{{8okDNIxvC&5SH?TdGsRJ7jp}XRZyjm|(_-Uu4tFt@HDwo{sU|hI#jj
zyH^{rZ_ttitj&Zhq^qNRy1TUdikw9Fv$Nc+{TVRFO9y89jT^zzeO-~K*5#S>gmN~y
zo9<%b-hgFw2RmJK&5zaAVFwT?3ijn#KXV&j0^^V~<<bM_Ncn`zmIHx8?#`FTD-?z@
z=B9;gfx>!?4X3Y_`f?_y;J#tCJ~UX_4;CF2Xx4VBPnRYChG(-wJ9&(L)Z+Epa7+6@
zvr$zgK)dNf_)g+gf{MdW$zSRxm~DnyucKX~ILcWiBn&J|DA*kbW&a%3>gXep+*=n^
z+r)4k^vzF;{X6hVRFXG@w#rs+@crL*cIKJ?7S8kCUl@pn$Saz$V`5+?u5oGSZ{0Gy
zB=PVGw|xgC=2P}dxKnRdhA2N@rv8&B!z+ya>*bWV10VzY`>%a7Kj$D;*e=eFs|?MD
zhWakKx%ci=g!A;fUMf}l_W(OW=9a;-hAC_BK~ln1StjvWB)>EF&Wk);3XArM&Mq{F
z2GbpR)ke@*DW%!i(1G~mpDvKR&o2Mv0(`Y_J^^yYJD&AKqa<Y|O)<88r}*aro_N(_
zkfa?+)@4d_c3JKHuiCh)s%62$FVgr{vfLmz_8X9R52_@ZwG>trplEz^jzb!FNK3se
zU^Ps!>UK-$*>n^>d6<r>TFz94jp6;a<%QW0T+5-K-W!!&QBjrYVoK5kj>>p=04(Me
z$uCL1HhBR;hxsz!Ip|A_P%51eV)5b$;G8c(H+TKevHn8Je*zPH9cfT`wd-@BBc$Zc
z%W%;f8>552`di((A%hZlFQNjLQ6^wPB-10Vc4hS7d14aS*Yeo4jvV3FZ;Zk`r-cW9
zp}BLvD-vJ)pAgE*qcFfB$f@rS!@XqnP~q7o)^Lm4Y)WRCj*?WPs)f1$KYvkfocLr#
z3dq%uVc_XmnroEv$?g7}pgrK40x=V#iMJD_BmFz-@a%&Xr$!Zd5O3Z*7{=ITiPQ8e
zZ-q(J+QOraTtiJ>i|A--Heba_*BLy^hVyvl?&Ll4+Yto-t6SPcl>*1t_<)d_jszSy
zQihZ%vZh!Tt)rA4)WwRGJ+`I9p*NGMCO^hWE1P`yoBchy%5y|{B%4!4e&p?4e(v14
zs|9H%B}@cAzJLGh8MF6{E6}vsQ-CXp`ZAf%Qq@Zb%4Jla6yb+8UavjNUmO-9Zgkn^
zt5*MM&t3_g3cCRzqst}@jE~ntI-S=4pp~@i<G;wl?kx=9MHTRq^-}hKXL$Vgzf}T2
zE7jfbm&GA6zhVi+!RswSBzgO9(B1!_9zU#rFqdEYIm(N9!jCt584;<U{?f4eSwM-I
z|D0nm?_Hp<ydsyC?i$54cKwTtM*SAZx?y*ws)n6}(OmG@-bp+&cgs-p?!(WgUkYZm
z{5GNg_WoG~@Qpp+f3S~|MRb$1W205~JtyzB;lCw~efWfg-DA@@E%S#31@58KsDFbZ
z%bPD*{o4Ga@RIi@S2v@~3`N6I;X>8;Dr?u@?epJ0{0A2pg8=uIRR-wK{Q^1{u70Kj
z2BjfXEV{b70GRO6)2CBsuY<=B=PsN*dlos*3w;_j6~-zlDG}>I6_{EwJ1e~S{*3;p
zpLxV1fm6HU6s4IUwFQNR+K<72WElxuG-2W1UED^gVXmQvPx#VbaqweV0M2*>x?<Sc
z`dJFc%ggID3G;ZT0R-egThdfUE`wLXgrNDZAB_G)jrsT5{yrx1ez8kKb8T9r{=lhk
z+1Z!*$>A@7OxZh+652|DHv>iF!iCEYOqaW=^UrHA-g;93RGFP>mmwNTf73GkbsNAK
zMM3;x0W*dd_Y3BBW@;Zld2-s3bd*f3E&GBs^@pf!;kyqX8qOrjy-ifH$f3ZcFJ3sd
zJU{n)g4lmn;?VvbA3p3;oW4+x24}s$q-|NiE-t>pKXR1J-?J_Az<j~WD4w;IahUZ(
z($Dh$%j$gxO-bgXg~j8J&Q;?}czlLVLq_ml$l~d@pTYkLK7XC(&vtd@(3u_9&lzz|
zdnZq_gq+{}!{~Xny5a|7IRE`y(a%kUL`++L*`Llia-1xziau-dSBaHJAGe4Ei&LI%
ze{JvPmW+CA?Y*o&<Do#}vSul8Iy?}vD*T<I{2y%d%w^y+p`L?N*Zwlh=jsmtQF!U5
z^cLiw2xkADHM_PB#YYDPQvR%UwZ%4R0(Rj=ptOVhUo3xH$d_XPdfWUYz2~pvy=e9Y
zC>fWNljEL`Q`1`f?(z4j;qHC;@?{0wAHEx_4J?ghJ}Vf=ItzmHu2iRS|N4PSkm+NH
zT3T8fU6&!kQrYPj0l?t+PE|!kGe91wRE^fizVU2&`p;rMK&$FEd2nA;B_tlM92F9x
zZ|+~&rUnRyl~==TZNK(2KB$r(-2?l+6qU*Na=U%=uf3=~bLg;`T+YXQty!T*_<j0!
z?%e4FNDRVci_gixKIBv?8`+t}n&e#)Ra$#(co(40OWqa!s|oBAJA{ycp%w2i3ilcz
zj<Rxt>kr+%cW=FU>e%vXeF?l1sH7q$qN-{gV;pA?BX(9Puf6&%`2S+W3E#g~-7a_3
z$aPl?M11}F)pBpjW2^7-z#}oq2Qmf&gn5NFGT#a*s(n7m3LjvcGx-}=W_6eA?#*$V
zm(KSi1jVc{<v>{YF!8bL)<6pY3d5ctD<fU2kEh?+sU!YAx(B11x;58+&e4Djonb)9
zENoX&LhWGd76roA_S$@s%S%>3wVlOZtnSOMeWw0uxO(}!8XCa4F|fKWK<?nk^-3B)
zE_&GM$zNO_?AAq@P0aX3kg@pNwYvS^r%mV>K$NV;OX{n)V4q8FYCT8zDXjcaS!G+u
zPk>k@tqP@l<^V-aHYMJjWUZYRPYU7Ih2aX{>#F+xS(z!s7O1`_y?gmx)-n*~3i&!=
z^Zf4fB}ilHpDpRx6tJ^-@d25#N67q~Gr$#%mvQ<_hibMubfYCm7)ZILcn34?`!f`d
z3;g+(QQrpeC-;2cYViNzR!!f}tDcq7gS36l%I(XY`KTqe%uWuec;cyFdaL%<ae!3+
znv|~l=b4``+VaUp_Jy1xn}|u0e9d3G#K)bh{Z?_o*#=ksi(!bz-aGY7=XLHqr`?vQ
z2TCZ6q0$ZTNRGGxv$p>>$mTupL{!iM^apw{l@|O+0)6J(>}pX}VSk5OLHAvLn=hJi
zViU7B5St7yK)%AEl2J)bDG(s~^}YUZySLnVJV>zW!d&@J_Hi*IOnIUl*!+l8IQUO1
ze>v@6->5j`1UWoRQyR5T&;P087awJV<zF?2BEh0@Z-3kfh4!g6xmZg+9MYzzF2YJx
zZ4mV#5zi#{9U=1uc)pC6v?_d16lpTiyawvyRF;dzWX%>RQ2J#%4i4x6ugfy6OgHNj
zOJC=-LwaKkVQUiuO4GlN0xVudv{kf_!fd9L%0cXW@J#GUOd3q!?%lhJ;nY-^wH&y=
zGg1)pBSA*_c$B)W{>M!1&pGaBZ_(tPp2vRQ%wJyq`{;YV+twd`*KYci-ND^U5!}~(
z2~~|1RVLyBg((Y%*PTtABi%&fqW<aP6&PoZXI@AA8YYdo=qujUd(yptOz+J$|8^wC
zfY~0+Cdq4|?l@am)}4*(fB<@sR4J0D7bGQcrYUghLx|amBEWzvx_YhBO~J9(6t+Ii
z&jTbU9K0kVlGo;=;L<zwA(!$cwTMzsR9Rg#uZku(zWh-E(_vGYg8`L#SA~?%p4C$*
zr+u52wK4j9)nO#<65*;@AK0*`&%|azxx5Ot=!czKPbO|w!VoccZ?3dOl%U<L8*b!{
z6O%4UM<c#Dr3!qQo*gO7_(E;(V3z)YjQVV=3JWjNpN|Tvn<u~{4CRW1a!E2xn57ic
zuvfy#$o$@8q8AL)o{SOZH<`y50=Z~IO5Bj2Xp=GKqLEwl-o8E!4QHF6xAafK4AkBO
z5r+4lK5NCnp+MTEPxr9{C;SoZE*|$VU2M;>fk3a78=T5ue6C@^*XB5}b%OBnD2HIS
zPLbqVdrh|X<RajDVf&7IHvpT-fO?S50N&E8C^sUr5u<h-P?Io6MnC#I70P@)BV=ac
zNA`iHGP;3?{y{-VXX(Wjfb`Fo65No3A+#ZLO&It6q6C$FXEOM0d?BYyx$aNlcykoy
zYR?*%T&#Cggpk=HRdpxECS{TUcdl7dq;FBs_Ku4<H~n;Y`|h1L)e7TUNuPt}x%B3z
zIo*rupLR;k_3BU|3U&lbyH_!#RMrPWm43cX)VzPcvph$ZxuAi-FgmJ6Py1jeE-9o3
zlNj)){rL(=&-&=xM`^ey75WJud}W!?iPhKguB*gI-8=pjslkpFWGG{2U$&k$zomaF
zVSP~m&#i7;Uu#78^y(e(Ubx6VlN)bhkFj3zXZDE>mjmFG+NNnr;IQa$iCwrdcc!mu
zI&N>wwZ+d*2pqD_eA*I?oSw&S1?9rI9NxYH3k|$Gt#CX_xdG<qN7<Yi!X{x+Ho;~E
z)_C`>fr$92CK2HUm1FBqCZZFUn~y~XxqreQEQ*9Xe=RdBUAFK$;L8~4#^*r??P(oq
z{ouu4&g;wsIXXq&TETC2E{eV81VTE@ssYiDIaP%Y3&?EFXIaPTh>oh>cu5PNR*%N1
z%p|4tW(hN!A{U>^$u?-CS+YliGiG{HCy>^cLr;}SlBX5+>=ijpZBHP5;w&^G0_VEY
z=)q|889<YjCKNT{%^gAtK`p&tOUxrMPTx7w09UH7&`7+ef>oK0w&Cqr+|a5&`1=w2
z{Vd>+s@08}rAQsBWs68_8Wk+2nOBPHr6;^<X`V7ALBS71^=(Uo#yF^*Im1F;&*C@N
zRl4&Lo1n!aNPNC=TMbfL)yNNT6EwJ%5&&nr`8f}?lM-(*kKetw$wEEni8Iz|+(Flp
z#@?q$aoYKRD!7{3pjp!ez_~jU%2M-vQXvOYLPIE0(%+G03s1(LoKpO$NF!qh!ixGO
zMkH+(9v8#yQ-)_?7ST6q0nWXJ>2MxPl3x9N*|`Y&euK=W$F?~Vswg{it+G%`BZE3{
zE?!SpRn<~DN_c$7&+@igV_3!vV+RC!sO!s<oksblXB#<`WLXmgd?mvjkI(x0^&F|P
zitC=yK)9}n1P^rY3>E6*;ZL63;Rq(ny*tUykIJ{uFgAWV@mAQ|0$~k=N_==#3bC7~
z(D$B)H9MiMTMbwe^@(UkCmF!}T1zy*wG;s#Cj?Z^qdP*(0QGL`irMiKAieUN1686m
zgap4iwk1`*uQJTJObOl32$XzINON;?@?5Cre_GE{dpb9`pu~OQ<<o(OF~_6Tz*8~0
z&XWQ$usdZ=_>8K4$g}NBg;v<!0x$&aSW`(wby5-1y&Gu$DWvF8%O9?g+k>#)O0PXB
z-pz05Pwph>pr1|^Hv+Q$Z6p~4%<<hUn+6Na5C|WuP3`}ASIfty3fueb!Fkx~m`LGr
zcfLZF_|<c_RwiE;q(58kYAbgF6qBH=Z7R&=Lx8M+DTvH|bhJUY_p?(<p@93-^qIcA
zJlD#r<{10W%_f%_4MF_^5SOLNg7zPY%szSt(VdY~I?;@oMZK?L6_9*}r?Z-c%m+hv
zGj87VwR7}Ez)+7E1iX5!hU(bqxey&47Q(N<c*k^2M7tkv<L+hX<(>*+sK6gy*pIe~
zFz<YPY^MwkKGSVzBzZK~LEz)^&&4Z9ccHJ~O)JV$kxKVyhdyi!W?myGlQYBZf+Kc$
z`Byo%K`>R6P|SK_JmF+7IWF>~iVo^}ei)kXj(I1nk;bYh?z?3ImhZvYg(s0Hh+yAO
zr{t8HIi#BPqAKfOj;Elq-)KwQIl|s$6(Id3@~jQO?MX;-H%vkeRBF3rvc7ER1=ER;
zsiG?RsX_v0dGIK2o=cw?ovqiQS|r<kL)(pLg`g|c1Jw+ARn}r-M*L<6xN+l~zA*VR
z5{T+HHdq~fkO}C7)cX?4@y1Tb>pdwQFKj_SgyD;a4+vcCZu^NET5%o#6`!eUltgEU
zCyiUZE;!JM^y0PhURcA>*TJxX<b|qTv((pP9nKB2MQe`UtSZQRm%hRY6MvxigRt}D
zyP;E8U5kloGBSF8lp&kiS89cm8VX(^{z<5UzKP5zf<d%^vbFIdl@6tMZo>BTRvMrs
zS_I9$q{M#uB|dFGPOco63>-~k!(`dCwAM`y8|lYTjf6eH>8NoG(etJJWZfjyCZ2_p
zN%#Y$>jQFufxj-dC8@Q*++fJhoR#-=!+9~8E=@l(=mj9K1=`(+kqVm-l+BVUlRG(y
zm!p`-i=f$!g+7fdg45(@Kio%lj#l|#{u_Y%|D0vVOo7aa?=N}O)X%(PMJFeGU5~3R
zcLA5CS|7`mb-6ebZ*cC|VZN_S>__Gxe;Q#vcx?ED<ofykn{&EvI~!I*LEp?llk?<e
zZ&USTqfc~6De%RoO5RV!#Uqzi?P|OG8n|mzo8{3j8Y!W1M;C@0w3Dp<alU9$=tgR0
zt)=Z_gzp!ebIh<<+F<|!aA@~1?5oK(E=+R?(h;RLR`D<b8#u;E@^TWBm>U&8nR?Th
zZSf{~g@&mZMS6^f^2$g&B;<IpTx+34*7!DDk$FZb^pLH?6R}unhOD@tAk8sM`1&(-
zNc-n37Jtw;prS{m8QnKh5lB0Iubm_hlv$~y-+UK$w^Sy_8gGuVnHg|u?;oZF>!K&C
zzrBe;I(3kNwuw&T0NbDy%CK&l>R!iyM?w#S>caO!A2x0%w~%!<*~2~<200{A3HFr_
zR#q36bCUIQ>LGW?^ov#1O_(2VAnilA(7=Mo=~<zQpv5MqM5TaNHRo&krm|nHGY8}_
zC?72=N+uGRfKA7eSNj$Hqs=3tqZ3Fhag)vLnZ8^MdYf_n>RA9tMHLlQscHx)xOxwK
z_I>E);RKC1n<di%5L3LlgFkD03l5yR_K1DZEr`?RJ|cT_Vf*jFltVB7^|hY@zBWr$
z@qyFnlW7%ohNLw@U!hJfEh}SYIZ*F&4ST@k(o`sNPs`+B>(BR{@Y&g29zZ(bWSauh
zv#bOm%y!Mh+7s1?-cFQYcNDtM0DXmQKKyuON2i8xa1AV&yhgQGdIgK`Yh{1X<uw|=
z6uHmaX&w96ZFrtM^WMTNuB$^WJ&-vw=^qRfkZ`moHq7>OK8$Y~4`(u&CRp>O{``X*
z-`T<|VJto+3&{Y8F`C8s#GmSsVP1$u;q#h;>*Ep}iRg-o>upKwsJt<E2WLS3fZ+)2
zo6TJDy)jm0?<st`+7C4s<6bYItT4+Kk+5LgC0!NM%^$;dq2bv<Yl~7iu0vnZscZ9x
zGhpwZP&70&^0*w<6yA?AP@V%QDZG0?*dyr7{y;icBah{lwn%klA%Y9}sL65eAyyDL
zs9fAA_g8bjX&F~bi8QFab2k}~A?fpqkYvrm(d~-pFg5{#fclKxrLNVm9a;!|>7l~Q
zK2%x&V=5+Et*0y<;fZAO!^;e7!_`uxaKbX4uZwmQ!dOZ2?w$?_`2oE45;%0Jo?@g~
z1K_*^+ZpNH(?FMe^G<TSf_Qt+AI|kdbN?>x3t(|gBHs4B7Uz{pbdjU8>K;s_e|vq!
zVIL#L;M+HD^T;eQvb&CPF!)fuEW_=rfjED6nF(5g-xWF3dH$8!_=~!1eZAaAgyg(6
zT3nLH&B;`JVI~IYgb+x3r6D&@a+9A-JIO~wo?187sxo2FF}V{HJQ&%fqvWg$Srtkv
z$k|>`SsJ)EJ53E>@r4zyu*v~F0aZm&#YT>sJf<(7(Ze#{%JOKtj}FtrC$hXKfy6!t
z`lIwp@l)UpX1-c)0+bv2aemfiBckZ(1g{!qTa{T^=5V<)kh=5HQt@2gtUK?Ge0L11
zvkuURzUpA<oD8MU&NkP7bMx?6psy#&yZyYy7%HQ>w9QZeZtBYOhUO|$e1P}|`?3LA
z+B=gaa^4$=54Gd^k~e30T$g^}Rau8(OBl<d;8IW#!G)4m0G&U?cPi6owm-*gY0}*{
z(02?!gj;wOHl9QZ-3bX9FCTauf|Be8%TnAX33$<~4vYKS5@of0VJnWIaW_lNxFG)E
z0{#YEb`r+7RUU_yQCy9$KI2A2wYfnu;=1G878G#k#AU_EAxITR3ab9(W|dnKkrT6p
zVpn8+`{qKoSR%b>nP}#)E<Fkf&KdkeKGgL(V8O#r+{o+UvGqqJe*78%6d-LhXcm`P
z9?cId;sDw}9TNLm06^PqX{p~{rR;LATQIE09_b=fi1!f1utS#{6=RnJtcv>`b%?gP
zLt&XkI*C6W{fH8t7W=Q=xM7(#_9WLV9dk;-{a4Zx6}xo-_by#fUV(%bK2QU5a%Psh
zs@3uCRI2+Wlwd~`n3xK$R?IcbDP5rt6{O;M+jHBsmcm$e_i}?dfdnhr-Sx8r7Ab7D
zWg8R<u4(>pLoF~F<XT{6vs<N8*H}r!jlI;tEOdtse`c)!4^?7K!Fj}~3?nt}&w~!K
zbJQwMDv*ji#IUpRZ>qGwqL_W_8)adEwo~cu)x)1YnQ8}4$eHYG09zk&Lv|!cm`$pp
z%+`&grao#(dvb$k+X50*z=dqA%0Jo01-ZcQmVomb3ZT?rl=aQ%RE4}JwOpZ6f9l#)
zt?o7Vxm_$>i+NUd`YDY5HTfm-@C%k|r$A9v4xpV?!O&HlxI-ghDJD7%Gn0Uo`%?r?
zq1s-5(8Z{$0_7>7?D1a)I^Mk7OI-lgL+x`LlOm5s)IzD*Dw%iy^{i0xF_`yEzIRNV
zV6I*|20CT$;6>o9V7+<8<ssy+P6#1MP=CQtN&Y(>!0fEbRPHRC2F|xEsT9m?Uz7Y2
zK|jjQ5xGj+{z;{{M5au^(h~!BwXk?Pz$dz5?mO<Dwi(L1e?_uA>7tPEAHrwbfy5!<
zZ99*>9>bSh5NQxU>li%~%d7YKzVi~<p7ust@6NO*UBsQ?n{nZy{gGvYU*rAP1{<3x
z`ywu9WP8R%Xe&#P;U#;A%GflerTiYbXOF5R*mH5KKW4N*I&Nutew?PJQXZ`W*S9>`
zfF#whBidqcMh*m)JcBwpU|sgiuSQ(DVt72f)Xc{9UH}k!xQahJs;lNXOu4oC`o}+h
zpL_@WmI2KIkAkRxoNWDlAa2oy{;*eKj^uZjvYCSNh=JAtM~D-0HMi}T?rYs2rQT6-
zfh8x|@*veL$EqxuJ+>s7e9P8J?Ic(ll17!>pVadZVi6>N!LVHpJqeJhc2MhLbXq-^
z%FDV~3}Vq$hn7{oKBn)Ln3r`gy;<h&R8(-hs6fiJX(bJ~hle6RyFoz8M9f}i#sY2x
zJ`~ArPr;773;xp)od53;><I+jpx5L<Hl<gur|oOH0#e(yx-oOhx`wSlZSCt7m1TC;
z?zB9xl0OV%?e7fPDRXL7UCqSvqN3tmWfbihv$`N4Lp|tKPR=kAj0P<glt;CBb`+Xb
z02R7hfCPEjGOywOq6ps3$b3SO@fhs6uYwgCP*eexQTQr!Q*UU42MWDrFWdX^{xaM{
zxWWb`w|)=2eQiu?`!5$@*FpUMVedVon%dsIQOm}Lif$D)T{i*(0vi!f5Kt6QdJzyp
z5s}`cmykqJEFho)A~n)$LMIRiQBY8NZ-Io~N$3GW!kxJP=e_5g4d*>~jC;p8cZ~N7
z`^$D^t-0o!^O?`Df#``OnHJC5n=F)rPcy%mEr8{zuLHAMr4Ll{UB%N8h4FOfqCf&>
zb|i4MF46Z#)K<PNXG1h1Bk8sZwnY%PruQ)<f^}U<t#$tqN)eBSh^?gM)}5|ABW?Pj
z0Td{{Y~^ME`ZC29sJ=^9!j)g`T+v&;7Awz(T!GlXf|N)@b8s1G+ad@5B!p?gons-V
zfb)ULgfyq3bHYY49y=so1DY@f1&@M0Lt8CfReKNM4V5zT;{X>l?eUheU6<PUgL%4M
zn%X&UnQOac_}-KNSTx)6zTRnoEW=N2ouDkYpMjVzW279drTQD9#4|wO5`3XA`AZu$
z&7FE#cSos@0ll@wUwEayxP>a6KRj;S)dlD}$+3Btf_tZX|0?GfSbpRG6Tw^{;PuuZ
zgM<{W?~~<xVfOl1L}J;g%JW>Z*j<CGzF7WZ*WIQ7-y3R=j_9V`#eM#q0cO{7w6f8T
zAAb+v&Zzr$=Y@X<K0N9Dg@v~QEF2;u`eob2<A~$}ol7##4V<)oqr%+__5i4Ud$;rW
z$6o@Pz&_6?v43~T|2SS;2Y?9i_S1NRP$l5dNE;rkLJPARHEF)3?195P`ydJwoUe;8
zIe=UEHw12{WB%l>l9G~x&YJ0mpq+FLP*;3)&7OL{9AV9Gu?s8wU!1X5$eRI$E9-2Q
z9PN)@F;i-4YQPK`l?K`(uVGj~K&1dmI77fd>2XMI`!1i>->u=3iqDi0uk4z_?hm@J
zD1fGN`GUel09s!N^q&BlR%x2Tg$uV3WUa2=bK_mv_ktl#QS9rt{1n^m|Jhpp+vdFG
zfb=M%qUnOak7nj(e3{Xz$jeJWzuSZrtZb3A{pypyK!ksYh=}_1DRUK?8ZHyr7Rzm^
zrXjSxc>TaX&jNoB_st>ZJ1^8UvoFrJV-MfY3;g#0_Ild?0kC%#&i?~o|IY!i`N=(U
zKjl_D+7<Xy)6aS~_VMn%D1-2qBftH5Tggkq_qrLkq4Ej7dSSqWnmV|(BP!R>Qc?<p
zYxiahFCwxvV`OEE?psG4JIWjg2^QO>V)}atJbVAVn3QqIsP|0ML4@PO`!Mcv##-;+
zzpuI?%OnqXo8w&pJ|*>U!oz!(k8*Zi&JGm2WQMxNbzN}JZ%=|bfTuzeUrW&?{lEqX
z2fOoo272u$d_D;by}%Ly*g7+3@FsjYTrF>Dj~L@aE4#17Pj9*%?LEH5kb}4OW~T3g
zVne@gXD@bX9j%r4+_J|d_8kbi*a{`MYrb}vsD|diw0$k^=KEcL+f<2JP!JGM!JRP#
zJemKUet!K&dT>~nK&3c(aaE=gS-veU8b(Me>x>+kanMP?+`pUIeAz%*=A-<T%uP+(
zJr;7X?(Zu*ymgc!T82?RX6FY0aKzDtWpXXg?)R<}0E({fwiLM{u=$x0@V2!ug}Qp1
zp>VXno&wcIW{>4`s1@w~y#C7?w*OC%?CZlYiBABfKPa2AyU)V2fE|Kc9D2d~@dRwx
z*v98#H7!|Y;`ko-?hEcc$To(;2iytbnkn2zDfIM5w|BqgBl~uS=8xaN1$lS={Qu>u
zF9KgsL8_JiY^cxu6902%0eu_Fq`m|3mb6mt&54GzY!g(WNjy|#e^?|9eedT_z{1vj
zU}s0>EZT$iG`5rVscouU<mUE*s%<D|-c_T%A!cWxmTdTKzOz_<HfocSVJ6bq)7RDo
zBLoy9iYDd=pP|As2Fsbpj2{KC7a8bNb9>UP9kMmcvDv3slTthH&ueM5j`VWJR#CP6
zCgFZPCZZvP=`ar$Pbsgg)|-$Ik5+$_@-lN{&kxf-xK?$&7F5Y{4CnN6j{6uyl%YJu
zqc=5k;F|_)=I&@=1N5i7<*k((asS6(P9;29D)9IG@g;z}hA>?e&Q^b5Gq?ZxBr;7x
z8=soq#F^toNR||8W#S4<FbbeP2cQSaMpb5w=A_Oh+LI^`J(qkcN(iE&87HGRE*y1b
z9=|?o4Tdb3L&|=NCWes^GTR)YtPpXu;)&>zO{+m<wgK&k)Q#*ahwkj81Uc{NjHnz>
z#`nooIg%m-W4|iy=tX9--GFgB?Pi#xQw(OL^6YF+TL@nzQg`-p)X5Vqop`CEw5vnN
zbL8cFs_{u`mhY>arTJ?!Te`<NAfsoyf?qc;^&5U8cV-l9PZ8^zuE6jT5-L7UW@40q
z2p<O8Pa<x>d%nI?w@&SZ=Xw5n2{NKf4Wi<l=Pp+AO0OG>LY5NDW7YybUT`$ueBV*3
zFNjMjFCw-5kkFpWtUa;h)mwd>Ql~&I{QdVcQL!Jg^Qs=CMrd6(w{D2`qR$X3BFwp#
zvty+lQ@iI)#&hz%mUToU#r07AQm|1;|FMv4-6E{4r~N2({CK5p{+v&hN|VE;+qigt
zg>9ZcbvnHPVm2pN3yxtk?WNIS3Z+?zTpRh6<$>DNfS_ak%c~o)3Vt667#Cdsrt_+-
zGpSTxT$>$b0XLuLxuc1gjq;?^y?;_UwyQ7VZmjy@^Z5Rd)=*PxU+J*{GbHS5tJ&r*
z1D(3#YxI;e`C1K)A6jbno#>1$^}pTqR(SNPzmrLFg3wX_qUQ2r?^pVoPhj)i&19Ze
z4c6v)zO0}5k>8&EyRJ#J5o&TRreMQ}Iyp1;$KZWjL0ItRjI(JD_30Lj7GlEFz6T5h
z*LI^zZB+w@Nos30uGsa?2eZsm@72<jX@P3|x<9JUDkmi?+mrN#bw9r2r@b|9WZ<i)
zTZzj^cFEDkzv3l{RId#QkHm4fIn`s+3@A~M6cql9ca~OGq1utA&gd97017NM8^lJJ
z_09X-))4hVciucYoi&5qAUszPRz3loESE&h4o?+N2+n@3BR69#Vq#*@FEnmBBM5If
zBn*-8tsv4c%)G8aq>@DPqrP%3q7X21=t)&YR0?P3s<X?5C*T_ons>Ftw7_sdecJ_x
zUu9X(iVV^pI*;^DXB*<OO-jqFeR}EKE!8x2beRrt#eeTakg-5OmWlor`b4fAAo%r(
z4`+pCvk)P<QaOya%*B>$!}%0<PdU6qfsD+{f#p<}=^is947L#y9@INLJZw_BLOpnl
zLiKT`RYV`FK<xZF92z%XVw65ruB%PXa|{Ukr@rL3_+Mw6pTox~pqZskncFau5SsSK
z=^FOR1kl|1t<z`QvNZu$?PQK(+uTdGik3~+jeDGHwfCmkv$=Uv+Exqeor=wI;9-7e
zO^@+v(bupmtLn$;w#+>khDXP|zYz4|($zn20GE&r4>pITb$0CJ*JrY{O3479h8%It
z)=e+YF0{TQZgukp>H#BqrYkR}S*Emu-8Nx{(CpBPSYSM&16{MpY7d98am2)AJet#W
zW=bT~stAK|9z>Vq^au&r=ZSdyt}olqodPEO48q8jwD|j(-%Ez(l{YsVD8-h8Dl)T#
z=AJ4K&Ye}s+?TX9*Wo$CuDLo)Lt^)>m#Ng*eKErs<Y+Z1krtVPsON+~c65spN>(zg
zWwWM_Isk|2zH(GrYN}oBn9S;8vi4vLn`uCp|H@2uX67~`u4c9|fzHz^3acoeZ*rfD
zWHYEzDi5GybbOj~H~gsyERmqo=^=hiJuO+id`Zf1cALJzJA)S`bQbxrkygV3$OZ}C
zDw4)Oc^z5b5ljwkJNL~Hg{LGxXE2Y9QolLQypUO;V-zc_ke$T^{)63S9Rf}5Y)ClD
z9VnRH=Abl9lZ{D|3$Ms+t7g|KMi}!C=Qx2TjvUIDII3S}gnT6i?zH7obZ7;uDjo_|
zDcP1$@L~C5M6LHSWb@UGOl}5RUT*9U%vS9;n-+rajg>K+Uzmq(HLZmektGEN_=3VM
zQosfdxQcgWH$^!RlA<a~fvtz8uUG6xMp+|H`C-+BOB#|fn13&#R;$O_$ShST4@cfy
zsZX6;U1cNLljoS48_CpJx#D)^XtN;&UK#&FsL1duS48&`$p~9`%Z5H(XW_7TSbd=X
zj8SQ&hEYjn@fTWSmA3YAc5;>entYZSCLOxZs1;`4vq?fgqGE)akjqsSwiTYP$VvJ`
z{?J`c#y8z|2=*ChWSv6%FiwVsQ?h#@&~>9>b^Yh|$LZov!q{vl&3U!KoVe1hcjwAp
z1<kJZBCbMP4q?pZ^Yu8q?i+rF4dN}<(Q8d6lfpMH-XF!FI%z*4RNaO8iLK~TBSJ^S
z;AB@#@_qiw`@dZI8|3>-Jfa2gi@{*50(!2DB?_A6+ci}y6Kv|%%*d0rDhlKreMTo=
z%X9_>;ihPW*89m+!75;KFG4VpeWbc&GLdIoNt>C7GR}%v8gH;>@5#y{(xF%c<cVVD
z_9-@Lh-3TQ9gtpEwy!hLk6977K%BLEZWZQ@gcO-<9z3+VxQyP~ZaN0MishdYC{+fU
z+6uZBFa~O((d6?{Nel0gUK94u7SW9KDvT{tFCP-B?2N|OvbEb#?h<ma*e?~1;cK!R
z#RAO^o2h*pWLL>-(N85`=sVd4$v%qRff%-I5;tb5UBtw0t+Bj+ox(ck=c-7u=P7s1
zY{uo6i{WQ}ml2SbW}Ps}l!LWj29#M@WY!t;o=pV9YrFJ&u;_0J^hW*24<E7_nB#ga
zL^H3M>87(h0M#3GI~IP#sNCJ!n&o`6EY*|EiPBr8Ur+!YI2bx0>H}1p9Oh8#?DQ7)
zyicF(WXxFsu~z{4&N9tCy%FBk6i+pQTU}Y`{)#P~@7fT{b)u3|SdMqR6D0p^6U_<7
zuh;PVeQfeWd{y;#ZaiB;2}m$8^-pAM!O~RZ6}4(C0yOG)NUb>eg`cX(*|Jei?BPq|
z$9YpETdp^uSQcAiR{^i#@MEgwBw41cA8-Ue_K-x399t57xjp9EOg2Yd#qz0DR%<G+
z2910a|N6pB;z@)pkF#J$Vne)~368}s^ZxS7V|O)S9=Y|ALJ1U@Hz;uGt9_wgBt5^?
z96Nf#izVzBRvhOjzZ~D;bvr{k+b|`2qB#~!?|i(B^D(-z)ju;FZk~_+#hLv5m1O0%
z+;y$ljt`zHp8QeFp-&{|D{{B>Zac>3`oFhc(chAmFNX%bG;&BDeI#tRK^*jd0__eg
z+z6t2I3P20g6uj=6<6;qt-)R_=U`kp59#%BG5>LxwD>ws6RwX$Uq{yf#WZ!TJSfX>
zt=7f{;_GywumlAu73P;}l1cFgL?CRrI)Z9U=GbJNVU#>FsIvCBd>=lEqMDYuhP3&I
z#G@HdRNkQqHX@;MAtMpm8&zJA-w|j{8|=i?mOsS(h5Ebzrx0;fL2jZ`<R{MBM#<l*
z`^B7HbqQ-dGr8Nif`|Jnf=0qmR3MNYz=og{mcu34$lSlZn&oQ0oWAYZ1H+VC^*s+o
z&->GWo!h}PBK#fm>0vGis7N*OsV_a@jf*!1CI4jhX<XM_u|Socbg3CB(P#Q&mCR=S
z#AEzB%W(YX)NeTK;zSq|+W6rp*ST|P4qZ7@EsBixbYLz;_ojXq(KlOHTu+h%D|$8$
zHw}CEBI_lnXr4sDDf(tkMfu_1&5e-*t-wctnZwrAkf;9mayGC{?k{4~(Dn5-H0G`7
zK2+DKPiuDeSg|J{2&-+?+5^`J2M++42tha)J|HS4ZCK&+eLAd)O5-{7z!&*GF^R^D
zYjAd1T}Q$_U({-HPqQwRbmtKEtxh8%pqYBDut$zky*>g^kaAT@MSIQ684bo=?w%V~
zgHvx?R;lh1sBq-0Az)GDKl+|e2m5}JMHmw`LYk4p#4dNWV$Co3$kDEsk-wqtsq3V?
zF3jdRje4<i)oU=m<g*iem_BDRiG>MLOi_N@kayBFze?a#J&h=FOrcGU)O&eq1)1yz
zrua?|nd6sDZgw+MkUWd|98wC+W;M3RfbjzlX?<{4QF*@G7GfK<QTqzs4aP~iBK;(z
z<>Tm}!^lanv4#k-=0qnNHROSwBeq+hO2OnD;74?tnd<nGK3mEUwr<Fh7BBw+oBH`R
z8<O{txdU}kt$fKEh9opD4HQ+)-v&P#;Qg8d8ClX=z*akn*#<1H9^=WxBu9ezxLj$I
ztgF|c!A5f>1_o9DG|-}dEPb6LssN}fm6L`>hiu!RA!dDNq3X#V7;o%WY;K`0s0m7c
z<VFn}uaH&IH*~2G+39Zrel38&fhvrRA9xTYY|t)IC$kWGZ;6PT@igmxj+|=>q|CW&
zguV&tm+^ENMN8xvMiyRYwL<{y>~+@W5@ok&`qC@tsUl0diYD@!x}#y9!JxlaG4NnD
z$iDwIio94&>!WD>Ts$>~l9`we;kT#|>&}7@qT2lYzwx2x-UE#I;m}JhV`|i3$8BEj
z_g3%CIA>3q_0Npy$DQ>>j-LdjphaH^oHkDN4_JS$pa8w}fkfBI6#t!*??3jfcN*G3
zKt&>c@qwEY98~vdZjchs7HMbodz~%NQhV1Jy=?RBx3yhPiIg<&f%T{ll9Ed&D1u#f
z=wrjWCUL*#eI>vR9Bfp=tbl{Z*gRr3VI47OD-(&z5sTtHq~VK<k57)1UG-QkQLT~<
z;0>v)riCj$NR|+<novvg9Y!`Sls;^)pLlS>gE=KbJ8|Boh6OsTYZO9s1SuMFom2(P
z?+ViDw4akadZTB;TRZ}m!2Widxl8o5Lhmq)4D2Zu80%-k+={-?2D<f)iW}wbHpBO`
z5^bpqHt#1f_$a-5ueCd!eb(Gx6|m26n^0Gp9%7#K5g#qsxI$f-2Ku)J*uD`O7hk`A
zasrFESw$_E_uXL3B3I`0`Cu$2U^m4boY(Bn@$(?|Y?V_SM`o?ovKEmQPFiaxAH+mY
zN7&l0hlJDM&R(OuI7BAo@Mnh-VKNo0t!oQE9Ht2Jkw(VR$uFtQ6JnkvGdLS+iD)um
zy4D-L^=>uC2u~)*m%gUdo``dQLG@tMqR!9a+LmTgCk;?4Qhu%}k69>1BqJ~dZIL~d
zUuc(oeDQc%eKieP1&N)E-S0QZ@_ljpFxM`gmkT?rxgqmwp!&f)L_svV)gHZgG1Y&i
zq_arrV4Ag!-AsC}>|D2hr^8(R@D032P}SXmkFLHXNo*Jz6;MnN)Q<_))Hb+p_sKAA
zuC0auXAWj^M8RpVlf)~27c#PdZYcP?VIwMTuD~4p>+hk-)ciX0Ru&R{&IUmUOelTe
zOyN9?H6iCU{V{ICLwFQJ9bmkJI7$2XDz3Cm4l*z+v*;X%wJ1+K&e%9nTalqOY2g`0
zF3ZRhk1uJz0eJXNqzDK3D>3YyqvnaJ*7(alUelZjPjaCP?>>G^w7nNI0KjISTQov0
zWf&~pUs*`gGs%b*hG6VgzlOz*t|Vxz^hj>gf$asl_EoPD&ZTOoYXEAldAdp4&GDpD
zUu9Ql8t#HFXz>`;5$k{UJ}UGXAhd`cce>@3fGsgCPZ$_p=f%^fHy@1-MP>Y)wY+z0
z7>DD2($6k9yBXFq@dp&D|7GR}w5V+v2+$*2on=_uLu$RJ`VG6X4ceL$jQQPWWN!4Y
zHrSN5e4?3zjY8}>AakXk3$M$pPN#>6%aKs453QXl^9MJ*0n2-4Qwvq%FwTKteTIX5
zfK9;G7Kq)PzVO}#4#`EopcjuF)*AiLS2cC3p^*5p&$Ms#7Y5}PhPn8&kM%16#yp<(
zRc);odwepURQct~z5NRa3D18DRRizuII$ffKiLWPDCuM8K?fvjy+NlU)@tpC(s^OL
zI76C~LFn7=59`}k-KiGY=S<YZdj^2f$6K6`f2F^^ln6xX6}cW)fOVx6-l(C?S~+Ap
zro9Z-);7R2k$6^g*&(aNO5DqDF0|N9Yd2h-UX>8GxZt?hI|r;oP+?m^(eaZG(F7-d
zM=OCaozRqQ5x91xixVP;HYkP4)5)5;1S=ndSWL$c07Ia1=E0G8??z@|*8`SW&yd9a
zgTFaSr}PItc9f1F&3tsFyH?~BxmvnLljlREDiM}|H*bVThkvz6B|Iu{?l&8yCCDrj
zt7*V&NRva(EJSguk?MzulbynHn#_;J82MVXGS*HFl}JRa4p(ar7HC~ZWj(S2{y`1u
zzz_oZ>5=O#-^tPzQ72b;a~3-FEzCu7)V9T!fP4S2Y33UQ=bQ81WtO@3+MPQpGl3z^
zZY)+#+i8ko9iQHh4vu_d-GbaDOT{&9(`6LPd7aG;<h{@)hm<T3H+`q0MBM`(7j+#5
zgau^DDW?=|g{=YkfKMx%c0DZOl`ZlDrSqEz=`yB=IHst1AENAWu%aji;O~#BjPnx3
zH`bX!b-f;DPxS~Vnhk6oWv#`_Is{5)nWiP90lA#<U@e20f?H)Rd`0c1p4JX`4{0|k
zdS$hi|DEgsJ;P6hS+gi7!Y|tPaY1U5V3X2?F;u2OLFwkwGE_oC?KfhwkR8y2AsCEk
zF8<)93SOuEqgu``?&I&B+{|}j5<JP@kxrD_oeuN4R!xgcD5$@yY4G^_(y`FDKiX!C
zUtCQ4E_ms(fXQiVb((^D=wQkU?q~2NBNfZGw8)tENn_4(gOh35wo%IqCMHVB$shC#
z6tVFm?RqP&?v+YbYC@G7_TygUw_|71=E6LZ`T`>VjSB!PP~e_3`~<8KBwU$a^d~3z
zNr7@or&kH?C|v_@rPI4ojjc#xyke%gMi#MSv_7TIh1XAv)D^**BF*0%W*?Z7K#`J5
zk5YdV9PEiNH2!kNJR$vD!}gN1)oN=6b!N`yh4?lsXs7AIyymP6$@8=J5Wq{AjMwu9
zkOFHPs{3Ea9~CwePyub2AfEofHH-}VoWfgS12t&@Q89TEQ<r&Bi}PZKUR&DIjl7@=
z=*Y-f17TTJKTeSvE2%k=F*osk1-AmIsp$4V5oP|?O@EVE*Mbfui@93^Uk82%`r}g5
z@*C<?>(K1EXQgIHQ4`M7@0aoHHXlwQbuwp5mz37bF4fDwHzF}(wdb0i=PxX9S($#K
zUBS~VspJPyqDG~yAvbA`ExXu0JO;i0!(Y~U!xk9tOucQ=nGI2AweJEc_H}Exppb^I
zqR-j^P2^Q|s-pB=+pCKFEw>qnCYq|JCtWr;gfKb-pER%?Q1TPOKSDwl%JDXm&rv7K
zf(FMMCb=v7tJ6WUk>PlDlxYlW?9y?H+w~{U0%yMPuD9(9@7{!iM(+M6u93Z9eR9Hy
zfy^Aj@e#Pp33sX1j7FX~*WSdQz>@u*<*JX3mSX)7ca*rsLIf%me|+XT`A<x3LH{Yp
zipm@rc)L(_&8sME9w?Fo#fV)>d8GVACyB-_j$znhxUppm(5~K5Rvy0;s@H3kPp>+#
z_EA+$Ew=un$iZC%LQlV30Hu=R3m}0AUZ`3>{FSsoBqe^U6TH;q5Em^3YjyCZL0wAs
zkRpBnDt=%MqyeP-&!6Pi&_*bGY76=Pc34L4{Kzx#C-nNk-BCHN9q;4kw#H)skYS7Y
zZvrxiYT7eGw1caS%Dxrpb*zr?#ru3Y@&6Tj;@kgXPvCj*=IS3xnQpp1&tn!%&dJt~
z!G7&=^WT-PvG0It?ynXj4w!0sbsX4orIH^WszO@XNRnHG4Pu6f+TzlCjMkUaI}PUo
zK<r_8if(7x9by88`?t>nU+E+7s6NMl!J3+y9%by@BeyR48$cr11H&o=egV8}U3dSN
z^}sLQ1u#mt`I~oPZ*LEH7o}rS{-y5vJ1}c^LlSBCYk}hV@cDchNi*u)gY-7tI$(!;
z<3{`fW8aOCN=F;;K~W+iBBX?^pK~ZjMT-`y?f$G_`d(Z5?c+t~j^MEeCtl~K{Cod^
z7Jz61{{X<TwDYRxIib!_?TJRCiqs4q9fIo+!#p|uIr)FFr!G}KZ7SRLrf4<YTQ{OA
zbE96qxBfQ+0XE|DQ!1ceFj6xzM5Lq)9Q8&^&cj|Y?h;ZW8{ZyOP&oWg0@lA?z>$Dw
zKi=si{9$g0sus?<b%)((7KpbSnShM=mHk%X;dMi$y1)S1D4p?_S4hX6;54Aih=0c9
z6B!S(;vce*Lq#(iCVWT9OsnSX+<~;)3!y`2_Zab;PmlQSuQC!4{A4=-P38ZyvV~`a
zfETUI*i&iGb^U<3U;IPShzMw^+I?Td*uYCup*<$Y|0v}?IHz9>7wg%@8R~Bu(y2(W
zWZt^&wC5bS`S~JP;iJde#{2i={RHZPg7DI-P_11KhJU|;$j8rs^Mb974Ypv3A@=iN
z-QK1KTlkxI@4lverOEX=tNk5cAjrp8L!~_A<=WiSl_DRppLuRx+s-bNMxYgK|KA=0
z^73XoA0vJ~oJ#wWmSMZclmH*$zvUMwf?b$QdC0QxToz1>fsFKY2ZIr5+!<;dTzw!l
z@@?_K|1!Yfz_TB%Po&;tWl4|6PJQ~6{T~txK72^VpDCSrBg&h3d$q$$YvYjcIS%&U
zFlWtnht_vKYn^8}cA-sK?@${$HH9bJEhtRXO!IFN#$o@hnt!tr0A>j-u4c)#){ZkH
z!J#K#@lEc1$;Jc7Ig_MusPr`2LG+&~27q(!+3?bs!_O3IGr&9XU!)kEjDFe#w&NZr
zoMFcE<dhVU=M&O<$clLrbae(nlMP1K&~zB!`=jou!k%-3>*BM-20=%)K@jou%S+(!
z(bB(O6~s_kiGl(G*>x{_j#8MP*Ol(^=58K6o4){ePtXc}^X5XO;;$G3MdxJ<7_pKy
zn^Yb&`cRjjdXUOg{L+c8`OKogY?9|5v__!wXL$<U$uS6oLQ<a^`tFBpMeoBexXeBK
zC-SxP{k#HM>5PRwTJxMX@HPE@9ArMY<pOsFkx=YeH`hJ<1or<M_mnjG7P#X`>l7z5
z=O1~}Hs8C;5qxJ6{TEeLuu}2(1Xv>XC+P3KCf<Ax3g{3GpB)|s{cBMp<t`wJxHhuy
z{@o4@0qr*LjfOvg`9Rf=|GxRa_KpJqe$TSwIS4aBEL;u=03?t<J2r59!#L9YU14`H
ze*3}3%e(LSjx*7(Kec<=BArYGY~8O#mzO|3Lx{$IJD*{ZrTW<m;9O!KD@QXkK$#e`
zS-|0oK5Ks=FGx!2Pft%DV_{Kjlpo%mWyDp!Q%?T1_UsgqMG>8lts1p#KX;FigB<C$
zudmIE%F>|HM%9dZ=Doz-2th$F931O;GzlxARsALP7>ij4!5rnZQ3G*op`K)Wi6AWR
zV=c;PI{%WCn7*X;JinZg!%}Ttu-C<t7b~~Ppjp(YFFsovCzt6(5D6(kGPt%HTJRlV
z^A*7Z(O%nIIrweUgvqS1Y_r>G4d3i^wqHq2;_fj#Gw!&Y0d`#!{N_D2bAR-oe{Mlv
zTUr&ays~cQyK%+TAjiOPG$PFC?%lg5Q@Rk_DFz5s7kRJ%5GF23*?R}p8?A3s5}mnt
zk)J_(q-P=&;_3Mu3uN@@wYhtjo(yO?xd*)AVir60&l2I99+++iAC4WoP>Glws|r3E
zGN5W@UClaJ{^(;^Xcn3cFd5<{9(PaF^oX_Fg2%myQ};B8idef|n~tlnE-H6aHfq$T
zO%BdpeY`67UH13Gz}f&7kP6=-vxOqp0)-8-b#mz|lS9<w0rwpZQ6lbTRVx{!l|Dg>
z3VnK!Kkm`!NY`9sEqU^cwyb%bw1e-rASzhvV<oJ^u%v;n*PS+fLJqBzTS!iZ8Qkxz
zB861e+V_bgrV0)tJCvgnGc@BE9rfdg+4b7G88VGlPOGgtc&4_wwVElUYb#g(ewu?d
zYJJ(&nYfNTq<HnFW~_DSvrts%;yq2yEdNm9O<12A+mMC#co0(<!P=-~VRG$guyZ$R
z@H4<XudDBN!cG0#P3y3p@Af?Ki(3vW!J>&Vvcj?=ndDNZKyt26mX@eROH(z%Z{yGJ
zX#)07I=YXs9PN0SnlMuo5NmUFJ}vmPM1Pe}cp?q<Y(zhz^RtuJ_gAUqqg-a$AF@@V
z+6+pxy%e?0=;bu1ayu*iLuL5`)#S`!I^gej<q#5N=il1+54FiH&8ILGmD@g;B=#bm
zose|ro}%TO-@n(MyI$Es%)<cpbMOqa#KSZioZixZ0^|nJW*yf&#!H-U(by(>{Z43D
zhT)c441nf*+TVLDg{)IhG3u!w{VeE8=>j80(4u<<WA0X$-$$dnU{%fhi#venY8wkl
zv@5^PqP<4@xL%Qd5s!PC?PI%Yk&cxnBSpu7vB|Ti*^^G+uKU3wa2!76O|k~t^`*;~
zJE<P#qlT?)Q#UWOJhsTw4q|5}OwP-Y^pygVv1^r<$cBCkggc@NKOeHHc!P^;mzlc5
zB0Km+?m@*NF!KG1>MPw7yauv-N*>MJQ(}u*U6h&T6mflx2a#3%SUv4r^Uv>EPkH6R
zOJ#XrVOOq5b}datuc&koh1pJ{(kd8j2N5k%N=lJ2iI#}+k1_AFWYdK0w}fQMk$GDa
z*Qq{tA7m<3SD$3HO{^1g@Wl_!vs~RMk@0Lfh?&my(57<Jx^yE-;B<k()}$z6e94!l
zLbMS+OxCMH%QoIG*j0|%R&is<Lo|SLrq5|4w!{ITrDCm8DDeheePZ>fxB|^kaXViF
zfc)vB98#Uelkw>dXs4u4?QH-&#;C||$F2!vlzAA-O_Xg`Ef<%q+%WTM`W_^G`4aHc
z&WT_ZTYmu3Hn9uIMSwUV5+$VHpHRbG;r!7zK~~C39gp6jEYRW+Tc7M@3+(v-1{uD&
z8A9=z9D;ZenQU3hwrdeG_KoWL#UtVPfdY_=t`-8kc55trdxQEhRKJ@nif$NS@-Wei
znaPvlkn_(L_a&8EMbr9-A1@hI#k)*(ssY+br!%c<k~CWrgq)#Ti*ycs^2e^XFAtKm
zZ(LQncMocSQ!xOyr%ydOoo6m{vOP71?;Kw6mcC$fH|P&1cSfG|k;iR%>qlirxtqF@
z7l;a68w1zU($XATVX)Qpca!(C+?7}H%M)BQeu0ZwKGcd%>RKWQUY_vZ2s(=P)NL_O
zSmM?O$JmNZ#au&Yv7Sl{t3%C8O$W~rH|+dcVzzO`OF43n1!G9bo%42uIH43@E7KvL
z=O(w&8FAHZPD7MF?L%GoQCpyz7nc1XD^QN%Xq7%a))8yR7+{I-hywGS-8M1z&8Q9b
z%B@MvHFfR^^9&AE>re=M^fBoiNFMMMiW0Ffj5dW=p((A|U!b+<)d>Z&t5!2yRJyNM
zyGQ>SwmgiDXlr2_qHMI6-bY>Ip}~F_PKlqE+eJh09oQjRXygZ7ce)uwomJ==m{&Kr
zaKl70Zq++_@khPS%7R-DR+cJ`+SCbowC#ykluj;Gk)EGn3~o+FcjavMIT+7g1z@fX
z7EUO-6(IvpF?a)kad{;RJIvja!6Ne*_Kz(;owOqWAmX4ui4wScPtwA@C>gglgu884
z=G3I*NvL&5gm5ydZ_7@U9U_xhy{lxl`KYcUNh3^@$#|cahXzS4bU2}#8(T6tNG2Hy
zq~7<8{J71CW~TA_&A3R(Z`|qQ+{cIH&gm@nBuV7v2KO}Mhc27>cLfDW3ty^Kq&G%%
zRe3ln-?=ljk!00bxH?Ye@<w4iD>_j7AMPiE@E4G9jmUf>X+9wMM@h*6r>3Xg+>q&H
z^=AF=_2(i#y?ZdkV0BlmyOXmV+GF1^;mko>I&1vJS+d`GaVX5$fBL%-(*0{yi6T(>
zY0EDK(gtjdNj^Pi&>t&TVWarC)s+-+hn4kV@`bxC%^1fYRz6v}qgKV1bOGh4V0TNp
zZ3w=-Vp*}hqeWqgN5eQP9?*-j;5GhYWu$zU6y`yFef<*eCjSKD)))*e<>QM4=Ycp`
zmd+CiXoK0=ybm}DHxFd9ETvkK$}U(jp%NPI1!K(jjQg)Vv-L8o$N_=EqW4k$U9eKB
zU?rXrn<y4Z0feXeXz`4gjtOBt`P(cC-WhU45(1?gU>eB511-*t{J^wEgeCTrfoAVi
zM|f3dL7fa}k?Z*n_Z7%4&*=~LGZP6MpyO{kUs2rM>@2ssew%NgCW7HZ1OjqLhq(s*
z1lt~-`D0ue^#&s45}3n(Bw$MoeD8c>9%05#&Y8@cnqe_rKQp9t$A!;H*?r+7@BcK2
zkt?O#Hyz+f=pEa}O9n9t^LOb!J$b#;@s;p3&tOhnVC1cfnnYLX+kVW;b02O)YiLy<
zRc28gF8Z&PRys+PnVhoR?^-#kkzJ|j#zj*V+tRuPZ=jy8bP+G_lF@-u^SH`I$0p*^
zbDG4bY8u`sw+;3@QKvyVnj*>E4?NDii(xL-nt-ceZgF{I=c{|Rd17wbhL7Yn`<#rm
z_+vSBraLEXp5UFW9e#`K6Mh2M({zY2AFa4D^&B|$yM4=49h`G=H1rva<DWMcplBLS
z&boRj^1NlTW<Ewi!pXO|5!Di8Qx98w2Hptmoo1@wOVP(kjB?9wG(HTv)Cuh2mp6Xe
z^0Xcm<cS+)#hmI5)Q^**lmxEj`FJ{eIg+&bEd10;Kw|T<WJYrvZCP<m1lT(GQn2$E
zsI4h#QS~m{@A+!WIhK1$acc5%C!Vm}y{yrq;6Y^FpD1IS<hll53-LvKt@8(@iLMNU
z58H8Daf=9;T;2pMN7~4)W;4_!-4`XRdOf-|U#G;?tLWtocr-vOekyFU`!4ns1PgJe
z5b4<RmdnSHvX&p=W}C0(ZfOHvWdJn@M&6OAZROEPe>SZBH9{uvcD==bY>n5ItZWsk
z6+U&-&G6e-oxa_cE!91Ux#>Z6TQ0>wVLKFs;beYt(o6Z{3)M7R^MG&i$MbEdcT&!9
zWK*372V0Pc%}`=YkxmPKtLzwuV4St0%gWjB-@dKaPs~vgixwDIPP7}#p-SnkH_-!x
zvx6=Uc`xf8ufEx(qw!nBPNVRx;dziibp3J}Vm?oM#e0Af>*Ih>e(}<N4$B{lp&McP
z?pZrb$BY(L7dpbZvKmhb$qN}L-J8au$?P+oL#9!oue-^ecf8D{iOy^q!?>n9rS76F
zZv!497g_)_z<+JOj8%VZP=uktcbi^C`rJVmx3*}Nw^aIEU)UdO!6FwrP?IMdI>-*B
z%a27wA2roe;=NV$+4}o6#^>gBUQ&xDLa9+}1q&+`u5eHZ5mD0-#7=@Mj)E3}I(Dq7
zNh!)X${)-#J~Hsx(yV0G7e(=5n&;)_9_M*nxk|o6YFwk>&9b8tIitZFk?eY<C{Yiq
z0{IXtV|*=?4oo`W?OF9m_g79UHpQ%>73k~gMu&b@&jTV#=4a3aTo(7=)))O$@gwR~
zVY|4IDULFd4;YOVq|o3nq4D~f-pgLDqQ8lRb^xxx4K~XX+VqNKEOwtPwCM1)(OL~J
zS4CgRiFpr14Xy6giM1waOe>CFB17XTY>bhzun5>R>!uc(iyEoaK_5o+l+i2T5$T%n
z4%~a43>VS){&P9O=Ne{{1P=j+fWBqHbsm>qsgklOCqL%t{%cxs*B~jiCk83kevuDa
zjD5GiEzmmGQ%7L|M~@!$hpy4ca!xF|E|po&wVal=k%zw^Hm7&ddFg!qMQS?#>@0D+
z(kc|*UtkD{c(mHlT%vY4Dy#L!5lzKu8-rlsl+}B3o|D1G=*!Jkb;aF6<1@nie45T5
z!<sL|y#J7`B^8?kr87q+#v~akhSwiE`aIQ1%iTTLg?vQ^a4g*UP24enitwEmj+WpP
z{8`_3L)tT6fiWbBTWWu7jC#U+4JU0g_M0eULEUSvT?NoM=Hbrc4==Z3Waka5zu6pz
zRHV5YVS2NA0K(RHkep1cWr#h919Z!nDank+wn*cY<%A&eYMs*1Xqf8|kDf2;Gu@fB
zEUJ`Ua+uu+L5!8Z^l7>F09!MpiFOhN6`~!d%psvg4LBL@C65A`^8%H!gIy^Yol5ZH
z<zAvJ7HVV^XZtc#X*QX*ig0r&N)f_^#oe0{?8S1kP$thwZ|$=@ZPJj{?g#F+ln42N
zQFC1^9w>Zl3SZsq&OIK{^b#ozeJkxUkV_*6DCKDc)JBajs$H;Vp?HMHMe**48Y%?m
zpM6VR%xgG6pBsj)VQ$UIxwr98f)ci{{yO*{sWMuuMAf=)Wrt0>*L=V$R`mRK3S)SO
zTq+|3YzM?5Q5F)GwRe%0x_HT59ITIU34>DpHow^yzXL**ym;?76HXg#U3Bk|9}L%$
zKIwC@nLahSOuCYh)2vx1SdMxrBJ%BHR9qPM!+ASQ1V5tEzO9@!x|;Fm&RY?rRmgxs
ziRF8O^aB8g_pWRV=S@vOD%M%$niO6DzxJ+FOkZD3qVLZjilOv()}`X0`-e#zF9^=<
zvnjwxkKK=j>2f@t@?OqUW!Xk7lT>1b$-5IK(?MXJFE(B`wE5<^W?b>nI4yXNy0-DG
zIQa#zo_4{<QMyhfm{hP&fv8j$=~CRYhf-rjJJX0hzx_pCdv+?tG0O@wTjE$JhWl&F
zz?oFl5k&2Fax>1cC#9*%(JL$?RPfhyAsDCSAes*qaYt&FD-F<gGF3veT?~D{tBsot
z`p_^;mF(;>v2u>j7$)VlKw19aUnlB!qa22Lo2sBK;5KUO$TC2r!B13X_=E+$aef5|
zR1j&`E@#Z~ZmAw~z*&yW)6tskM*D=!nq;NYc$-bm_bZVPotP~TdbmxfG|1DA%Sots
zv^usx3n*Hr1LnK@O9hOVPmiMC7H5BvAW{Ct`t&P{gxRT{mlamca9AR%*n@bh2^e{S
zk@zeeYqGt@8syh^?SXL`7@W0J0(iH=S4UZk332<vS-9uAV|z*R5x|0|&Q-)~ZgF)7
zd8nNLhj))*Tugs*#hSpOUF>y_JpQE^O1OE9VnHJXmXsSi3DC{F#5=4@VmD{{AjS#2
zn7r;3M3cVF{j!(b9fpEYIjGicCWiDV+<Hz$9_yYsQqwVb!BN$)vrOO_{vnDf0>8CY
zA<+ECv{Lr~ARwfqr~}KXmNsO=wzp&)%J{qkzkaUqpfj_TbHxtZQ<UgniDUX<$UHcc
zLAX51LbOQkXtqlq)wcWmsXc9Ve3Deb<c3nH5RHt*^&Pikws5w=ik@<4Vx4MKxJ@Dv
z`jv)C9Hplc54$YSk2JM5D}?md*9L5R8TN5G;u%{ND&g@{kkp>dN0LYnNZ(~I=4Ytd
zfHlKb1_Jc}HTg2kyG|OzEGDZCc2*R?v9DZ@sKpOg&U-LdPqvti(FW8;-}+kyx>{Ng
zY!==zcDN3Z#_qs}j-gsNv@k2vb82V$Zl9jb2@My05l44s&Ixi2>F##}gk&>>|3JGN
zp1FHM>X0EHqr@m<798CM>bx68^2&SV?G{+?tdZpbh3eL|<++Hi^g*dAXgwU+Q#P)E
zWa<YZg(L-&l^EKO+9@*4RsXrwOt}<?%5lz7bWeX5O03I5#Ap_re+F<dJ!O6Jw#+~K
z%Y3PEX0L*%euI+X1B#|>rk<scgVp^zZG_IF#?~IW<1$*BS_*BVBU_F7DaAHjvXdP-
z7MKH+^2%x`rNVZyP{O%u?O0E=jBT@rqx55O=5Y!TR{ZCFs4rah`M+@icF;gz?~J%q
zvV7g>{0pj3#hJ*M*!0&+5}+V87lpY7w~tU~J{5LF#lA;-9VMLOIg^(EDYviN{>@J{
zZ8hEU{7VKQVtHLh31>OZkxLhC7Hn-E3tOwk6BM!?Hg2aYX1TH8TS{PrldIEi7-j+m
zmXAoJ`GH0DTfsY0EECG-1UUt8?`doIH14*q2)Rx_rz$Mc$y=<pS*m$j*$enr2O!eU
zU2+~op!k7NM53)YA%7uepK=;tJ*T-~`3rs3&dky{n>5|rJM~E}i;G8H>^!J#B>354
z#8%>OQDSFO#_@Tbt#vA!)qa#-U>+k3DP2*xfTfn>#@~I2PyTd8;uv$2zxub>dA4)x
z1uc*RYcZil4}5zS(hT(U^`hRr%RF|DrCHu_*zb{2GC;W_1fy2vg(QB;A76BspgGPs
zPcrqN2+yH}8Ki48(|(i|eYi4w+On$T#G21Z=#TfOkeOGksq)>7wI<5)R_#yDoKK(h
zu5TKBf;RI+re&l}PUSUiYHJM45>r3#g2z3(ywfsHIdfzfX8FhErx=?wuO+9LnEJ-c
zL(A3ibLX8QpB5OPJJhlA({-c1f2@lMd;=WAt6}JrvNCxzk1zaIPFFFhz&S(M5UumD
z$vNju;)f42tOr(Y9!;t~^s0}bre`{Bv@4%%Vfo#)fM+6{WH`o7WShOG{^cuk_CbpS
zV&Uq$K%2h;=Jy?U%LmyCHw~wLaSs|F<*2(bXK2B#?pH~EST@NoZB2M|7!O!=^hf=+
zd_d1wUcmNG6!FxhUw!A_LHAzq2uLgdbPuWRd1drTY*g~kJOI*ffAX`<$FPo2zf~}q
z+B2AYN3ez*0yl09Y$x>o{?GQ;&GQd`+236Py>rBl=L3EIP1m4Skx9Sxqa&(-7cRFu
zGQI!-1PIsc5yCq_A8^9)@y>z&LifZI?gD#AmZxnXhMI8;kU`;Ad)Yx8-a$=<j9E7T
zKB1hx3{|a$;<I{B?Q-J){5Wv)7uoD9;4x5w+56+(bNq^zjyx9H3Q(5c{)+&Df?uP!
z6F|@*jmXjVMjiPTT_A?;y*n5tE3z)D6~4P1cj)!GohL~GXKaj%$<uAGIR~2|+I1UX
zMF23Qqh$KZBgx%I><HJd&4(FO$NQ#)&32h4f3H2)egpURYM&n>100G{Q!jd1DC%EE
zV-+P7{*in7uTfDeeHuj7pYaA=qn&Vzvm6{8k!)PR8|njlq<l1pD=;yMy<Ca6uDKj~
z1C3J)QaLm`-s-yhU4k|4;HloY_sP!?P2G-OvSqt54pz6i`5jD4)BnrJg7<<8Khft*
zs%#_3+1*OIy1F3y095K~uRkaHxq_opmG-@RZKR`+)o&kJI+Hf1WitW}+6)~YpTE18
zcmA_#=H9ooJgXkNZiM1Y5{J=LZ+q9-e}xwOXU;*+@0jU?GSUiUL?G>PD)++T_1$4Q
zfE@0aKD>OHb5BFFM5yOZ-M9N*CFGjwYSSm$zKBn?;?SqA{GOM8U=)cI7JbY$(SLrF
z0IdR-`EudZ!U2Eg+4=CO`lD+@#NI%xQ<x0dT!#|XcA-r1H_{QUJ)puPzrB9SHUzbH
z5A>_Wsha#*O`E$=MJH54cfkq%^;_@xhN9|@c3-((u9^)D_*I*oe?;w${DFIm+^Ks$
z+`yW0?se}sb#~B)@%*;E+&1<-`v4YKiw~;Nj(d_!j;Mj3`OGD~XXeED|49J~mvo0=
zfI`D5LZN)P@nr9z`LfNtlUu-BiGMzre&+?1wHu1Ka^*_E_R0S;w}8f$|AokS@$w}W
zk5i<PB%ff80N|T>zN4cf>f=WN8iC=9XEF8n-=$aacLVpy=L6<CysWGOv|qsmC;tvE
znEMI?!6C&S<;g~x(WQ)wX@a~{pNbUse6N2Ud7*r-OH039!YoZK^xWywr&spFck%@U
z1o`=uW8@e*D?L8KE2(j5ve9>k+rB<gZ&TfSWjJ?N{e$#n!&=IjNY7^GV_5;ofAaCc
ztUXVzEWEPX-m#Ln4-UbFYTMWDBz0+hoWb1S3X9(ZxjuDs=m~Q!%!nO=(5;@<78Vw+
zk7_;I&Ey2A6&T|kfS;c~Yv8cxIsYyVz%(F>AD-N60X!Lf)8xYyR&T?Ba};4&*?yp?
zc<uaG>CXM^7)Ok=nWI~!DThb@Xtmw**`8l~x7gejjGMX5Muf~m0qgBI$fv(k3(lN5
zV_?~K4(M+GH>m}HI?r<U%$eK1h_c!q(t^Trk3{`I{)0kgW;+_&k#NJi3F>Ftb4d)0
zHS-?#asKJA-S{tH_h9w}zc#pU%6Y--LMmMSz}66_^zJOUFQ-L!%AOkFT7+CAuQry6
z&pZfH6)7H%PbN3P_h3eRxxfaPhGS#2#MZn8MncZP&lz6{OsxA)5(`o$cl|e9Z+`8W
zz_kig9{(?s2dd9MetZcK#egkBcK+0{@pD%RH`{`NF`I>_+}iF`m1nmB-4QX>M7_=@
zxl_7;`h~Pt8q$}qKwYlr`%zip_hH!k=`G@WP`e0A?{VRMJ5-Msw>~>*6@(uch83Lg
zII#QMy7n53$l=pPnXevAz;wsANZ|`agh=Tgm#x{k-}Snizs3*1*?>D_UmMSIAEl;j
z2AjVAoz(Z}#%&XSY_$@IGT_jAYdhS!>w7p476$OM!oH{0Sax=2mD4Cvy_<E+QApGx
zmCHKUd<f3lwsb-$JHA~3uN_19SWXI(!W$)dnOw3OtgC-Z%FI7gF_{&?j=5#eyL$bI
zJA-%RW;IQ`if+Jif-|E^9<BdMI(ie)uH>>o3zjljs}nYJTa3vzEeN<kZSD_f8*#PX
z4>O-1S=R38N;qWSxKPoxzP_m}3%}P3PV|iXo>`X?Iy0YHL`NhhCIyAy-3TvVzRY|S
z<Sv``(@pr?xoLRxr(z>yz+wctY)V7<&I?*txy*HCUc}mSG2Fs&(T%0a19kiY*hmYQ
zCEqS1|BO#{r|heh9jc~f9t)mZuur@)-B2q+kCq6Y+kAeO1KrtjNW^3Cl?x$XL{KEx
zL^92laVw@^_AD{eEV1r~MwtFgE;CEk7NCEy+*r-7VhqdRq!#TBvhEk_3?f6gWxNt?
zn&~>DD#yFsPRwo=H7F2nEH8NijkXY<q#3yJqF7}6gYo*0-h@?rT0;N8we{D`lse70
z3{HZ@I5Pq1ZyD^+otd1NfL?6qRazI38^~I2b`oY@!f!147@$mVv5;U9vGJ`saoYs6
z7L2EDYq}-VH0H9SBf+OOdr*_bj+~n0?_9fepe{|R{0e-P{}1W<dG6z|^zeU9iJRwt
z5eG7VGxg;K20Yw~9#;x1<n!LW{v%3$T!rdm<B+Upp=fm4459Nnh^kIDnAi*-C`~fb
z(DPl5h$@{voW{7OmnGHgffx5taRvDU(CrOVAxN~y#YIJB6k_sSJ)2Y|^+0ctw&K0p
zuU48cEivpdhfRZRdI8Kk6+vOSR7sV!yRgjP!_xYKjbc=j;z-*ZOm1?92T_A?i30?-
zVuWS5*(XkZYJt9<o~Iv8Zk7CY@_xE!v0P`v8KPdOLsS>KOS$ScTc@CSC30!$cD7N)
zOTCVE&+Ul3vOb#jKo22rp-S(&JK1z2RQ*<u?|Ji}L7BXHX339!ezy2h`fA2sR9#Cl
zbEz^o6#S<Xe4y^mWKj`)S3^r>7mX~CF=VeJelBFYab8GYNMC!<)fdUI6i-XD?J@|T
zUQAG`{xfQ&kFWlLltt2om}AU}#Zo;X9K@DH%mXWdrmoTFu5C=V$dL+&%G;Q%5>Ajf
zdBVt{KQ3g2hIH&)m@=8^D^F{7Bz8Ju$Rtq?S@&#?&YUbL&1ZEU+EXK5t|!9B!}+;g
zqOCAyXxo{P1;Q=8@Ok=0v1;4mb_!Un6QDmA8dRkYP$TEs4I`3x2R^QJdSF7cD{I~w
z9o}6^=|xRiz-n;zI!OV>gS`y35?uOsg-MJfr@UpDi8&l?o^YiHrm);q$2_2TLE;`?
zT~m8BiJt!B#}O|VXpCG7?jSbXW>wff;M;ErJzI~B{dgVMa8vyhU3uD%eO<EI*&x1s
zrGJIVpOTU{IB6J`ZqZWeqC&UGk+JKKV_xmZ6ER2%uupJrU!3W{g}NYynCL~8MR7vB
zr%$IBv<zloNZXA;)M$(yS{uK0Z<!UAWC7oX)Jf&0<cKLiddwo0QSX4VDuIRz$9wl|
zGiLct`un<;g8TG#)vR1>u2Z{ruZzi6rt2xBzk>F?KedO{p^AiMXhOWF#v;NDC@v^i
z+B=u3QTst+PC~7=#Spo{coeA<pp;yz6(cCp^cc8~PtJ6cd&&=M@rrGjix{Ewl^!KS
zeeV~kSg(@1RThuli@i=g$S;sKRmj|;lZQr~Wsflso*HDqyCeHHP)P8yrZ%OA7?adR
zF^GUb%e?dPC2Y9OTR#nbl4)iOenUBDyKf5JLX5vwGQAkY;MonoJk|JXyYzp?Ma-yl
zdmmW{xlre$`z^)?=!b0s1_*+jZTupY+8ax{_Dz*Ff0}nLR6+1{#a2e~#F#6cY^ME8
z4=z<YZ3z2_hK8XsxaF)$oa<bu%Q-E?Sva+4W_3p1u8i3L)m+(=ORfxBF^`E-MJ9Y6
z1VWFePV-Z;s#!`KxmSc&XF6LGV6v?JxuDHo-S-S9SGKJ2Ny37iz5QK<{|_5^D)(0I
zOm}uVnH%CzgNJyMBJ%8NMZ&QQH=q!D3m&@>mL#@NRjw|=4Z(*Ae-wudF(fAgrUFOg
zXr4M*db+WHSv{+=z?ycbDCWwRWXtI@cg{b1Dn;QC2<I5tbg&MBZ>?&dm?0QnxNyOL
z^SjVY?}VP2-%sPhFTkx<tNTQcd8#wP$I-{MGFD1KWmeinH+;YLOw&>AEDeofKpGu5
zcqm5`DO7$%sfL%F5dk<YAgA37UwN3FxH@r;$igmbDCa|Q8=cYai?431q&l@I=EV4W
zR+>~;jjoRL8aIE3cnmjCqJOH*_m*kI;qG$ExO((hHWAVJhsAMN^BhU7>$eO<3|hkm
z-8NUl@m<A>5@hpPub#hfOO5if!(}N_RC>!wds&|gSJQS%3%u2_V{$h23`gd+=KR3z
z@LS=PxwOOH9Wfb+nIPhPaFDI$<%+?etkhNb%nfDbAjc=$oXacCt~8np1zkx_i2~HA
zH>V@6GB#+BziyKpr895gOtK#&IVIr_&;5P2`w!>T-->?WmgeVQQKxfA26ughg1XCf
zj)m&@S4*e0ln3A?De6kT+mjaCnG{?Lc1f7-+H8y`{jH~GYLaeXjJ6<JrJ@s4pqoC6
za+Oq<ukh!{j-@Ea5S&w3Q#(0;K29!{maN#O^Q}w|L=VROCUYX79(P&?)FspneQ~We
zKU-=29&aPi=z=_SdWJ5Mnw36RhBqS_M8~HYM%zZ|7Y12T{8p^-HBji3CB154E@F^D
zxx8iS*yGy098MBr?l=?i!OM{<eZ8Bx7YmE-CtbOy+Q&sv($nwg1o7h7rIDh}MXWl=
z8lWj2HTOmMg-Awzh$ZtB_BySzCH|2)8lDAl8m5c15L3>C$@hENlA-FwV>xO5)6;Su
zo-M@QeCR~Mq=3Uuxs*X$R$^R4sK=TOi|yLQi^9@k<}G1~SsrmRZY&2YL5Nel?lER&
z1Ji&&Amz{F;qi>1h`zS9NF1&|xjNrxxRx&@Dyj){aT+~|f7B&QUHg%2EPlyFyIO(B
z<cxP)Hl&`qM1zgVuW<BcJV)ELnO>gY+_x>L%=Vvl9dNkG2Oh4xtZVUtC&m^ORM(>u
zb9*;%=Zb9mwqH?^gL#c!Ap<s+Mp_0BN(9gouzN=+&ZR|6-~2?+&jwM&S-8h+E<tEh
zMHI8w_KE}wJ;9H{4&rm+WBLcX=Dv*%*yFwoR?{d5WAy*k-j#<#+4gN&l0B6@OFSMT
zgpd%jBnm0UzC5<96O$#w2#K;x3Y8@xvNMq}%-HvBWE<<qo_!sIF?@Hu&vAU;`#gD%
z_dAa7kMEDyA9FbFV~)A6`@VkHb^WgE{GI1n2ZwK1!EwcXN%AAkULbID8OQEO`2_jk
zW;Myeh0kJp04iQrjyyeFzjfe*hZ6cc<}e8uRQA?*(MQ9*BTRyAizwg@5NZROa_o-q
zL@y2&6;-Q@RJZ{(VMy}Pc$snEg!xCUw7^dc*y~zBQ0sZ!MF%hd3m1}&^UN@>^6nSq
zWXJG`Ed~oal)I0o$71*gNAEpDAz9E)bpa99EGQbcD4DIpOr*A$pz;{+DpD0x_38>g
z_VFzjmxTbYWu78ULxO99<?sjoV6!+OH2>ZVud8n_qPiM=w1MMR@TeB7Zy2MBm;e<R
zlLk5RA)_5u{zrQ_J;Ky$zlxQ@>?6mOlkL#yI+#Mh)cLHePj0rwJHYh#w%l_95WRv_
z$86N{j<fNxmjfz(Jv%@F8Q>m3zW#Y@IE)vXS&R2X(2A>!*kl@gH4}#ZLh7Y9PVmS6
zN{F|0GH8rtIw9_Sep#wpeD#8bv1r2NqQlKc2RAOnImRPk&wCRcx=zM^KZr@rN<#;h
z-+-N8e9hDhQ1ge%SG;PHV>~W6ttNu}!9G16&pr=)FBj+sIICry6|BTP=C~^NSYikV
z-Z{<7s(-X^g2t^hf|!4}hfBEkZo4-u&qg8tBn$>%OqgMOd1`{f#RtLS9`>@B!Yfg7
z`8D{XYSwCi&`Sxp)q*Q_rp~7sz+56NM0YaE$v(J3UZ0hO`T5b}j~^Ynl86W=EJ+h0
z!b0exwz*6;1BD9LI9)i>n|21sI^!T%^Qe6BXT@Row2DLP^?T#jZ7O!%nE2%yXja)>
zEw-HN%&|L#&kgc*vo<|zkQ}fgcw*pM`*vp%(v(5<P<z^@0vk@U2_)t7am!2I^aqcc
zp?-J6XLP{Ff?i8rlX6ozAujxAPpd0v63`twD01dQbp-)B)c0&)Ln@~bi2%fnJim;F
zk3qJsr{Ei2EdwJj4Hpzo{vdu>Zbp6$iDwjB^a~~bZNyQ8*!~m|V`TsaoL6(Wk#|A;
zjgO~E{KZyRwBvlbyZ0~3snbWjy5W)dF#AmQ7eh^_6mXv{<4@6lEpKQs&!%O`0MH?g
zoi1J6sDKR?X5J-s+b`>T<;g|3ZYwX>(Jk2g`qyM3t5iZl{$M_KykUF|okZm8r!v4S
z?$luXpkDwV?2O!S%$+D;gXiq@JyGddo_?Y0;&5)3D_|aPyma`(9{JIIf|z3EOVD>$
z*;0m);7y)2K%ofq9Y0zr_WLzmz-Jl)7WbE3vk4{%acHU%)c8S(P6uUsMT~$j!%duu
zu2gi8hU!tJksp5Ku83S-F;jB6n1n<_*KbF_3fBL9D0AE$5cIH0SBFRUj=qjS8A$=2
z4IxTZB=$2qk`7>_7gg0~;rYeUowpUJg7?~k=>bWT4R^%256>aQXU@RAzgFcfr>s|O
zzBE`k9u2Tx4;S^YCh%C?1B1ZO_b{(KNyVc_Am$d=Ba7T5I}Oi);89<f-Htx1z074t
z2vD$q=VA6O9<jI(rFwK1i&oaafZeS=uH#9bLk;xMq0dU5aCwj6)oNPniy41*Z`nf4
zO1lo$a3yKLfkmH>PaYprBcbmOJ`J!ZuQB}M9MrJ)XNCDwDoHe4w76AYFC`jj>*1M=
z;rjXl?f*2xHMQtvNn`<BR<>+@{??0qvg1XIZos5oHCShVejG@+hG^W@g51k2Zp-;y
zJXgF0$f^)3Jbp(d$eEF`+Qf}$5dXbGZZkV1P{uN0fdZhk!9fw5gXOA2fH=PVI7-f`
z*Ag^M>Se$_EG_bDTJ_4(r5^?G6I{{6$M;CpSy%ih51Wa$(@>6!BxAW#(BsWR{52q5
z1p0j<dLeXY0wHb!S5f+k>?u~6@rN9W0HfE*LscOl8-g56CkXG`wh;q1+Cl&^|EG-@
zZj}uQ%+ZEIb+!MAvaZ#`%__%LV)+VFp_H#1i)peVQR7bV78MZ;&HoTEpu0Lzp5svi
zP5YWHp)`hNFJr05N{#g}6lwVqAiGwI)x@gsL8s2j1xzKIZ?_Sv;Um_4_2GNvIz>48
zvp};?ZgB)n`l^s;w7I=O21uPk34K!I)@z5--a<2v-8g&aS%5n$--oySh?|Gau<Mp1
z%4`pE783>*DmyHPQ`TSy4aA;$zIw|5@=CQA0{AH7+Vhnf3CkPa;&5v(2w(Ldywu2l
z?IZX-en1S==|=(*qqH}L{V&s}#}F%rN?#VdDoN#%t0QZin;B5GX^C!&p*5P(U$BJg
ze)@c7vOSy($}SU@A86|r<&P7J#C9i?DOf$f_>R7?*OcobU3;|Er%mbf7m=sB(ko>p
z?_A`1muDhxnLg~i#(#rU|CDH5xVeRO%@$c*N_CdPtXJ<{1Pq8E;hT<x^$+hALst!|
zcW=SrZ@<UdsXGv3L2iT*ru~O)ETm2}@}+;{Tim$&qvB!d2~J`~z8g$5nb71^Gulb$
z=}DPhFi@rcA?4rNT426vVlkflc#Rjgh<hW(wjeI|niR<XWHcjhP@(vDw1>T2F%5RM
zJs$rl%4FnsMPUhSucExHikRT$hyMG-eUo%|F5=~nq7u*#9%Ow3Z080=tx~qiWzn-|
zSBQ^0o13?7B`Dl3z}y2vs}vv;X^$Us0A-CLqrT4WDPr;BOYC0>N#ja(7t(1R3tq^`
zFNgh8qWSaC`TUO)e2v^xEQ(SRE%os^jmL!xCZJC*mH6tr7=X~I|1_Q51(AL3q3vbe
z1=@lQ3CI<I^bpV~V~lQ=a@c)_&wk6%KC-D~x_XHZV<>SGN8Of+;btwS5S9zzIQ`iH
z6D%*DW5HJV!6))Sh?M%9_N-r2E1x>|llp_aSrP%@r4<uD@zStJNiyHp)gfvHS-i!A
zD@3|Y^Ag{hRNJugz&`8o#ObHRz`K865>8Ox{;~aErK%@Q@lylPTZIZ;k{lQjTWDh;
z(XApk5zC6_Pmvz2wnvJYh`!0Z(q5<Nz0TL9yEbG_TRwN<pNdExwCD6wP_TR4(p10y
z=dHfA{)7V&KY>kvOH4$Hn1GcfB&;0UX9}uT*A9<!GCy_hXXFxT0iHNZeI4^!R87lq
z1gF@4l&u8)d<Nj-SfSg8KSWtr-aE#@HT`WIuGRSch9)MzVEQ$ZDM0b#sM+qcj7)q|
zQeI=Drm^Xx@J;$8Sv<yCSMP_FyB$Y;CfkU&{%PM7$zO~;;3%p#PV8rDw1({@b=tIu
zLRP8(@Az*^H+0B}^e%%^|0a%FNfF%e2LPigIZb}0&xO$a-&nu{K=NsUwY77A&QE;&
z$4v$)Z0Q{NFt+a3$J;;RQ21tTJ!vTa`u+b2q;mWfNR=Y0>xEm(-J^#y|7+&9;LF61
z(c!6Veoa+Becu6+-f3*cYVx~x3-zR#8Ha>JugDwush0-8X8jEa{^K#6zrZBnL|`+m
z{#Z+01&|(rCI|hf6z}8>7TsS`VhiZ)GD_8Z8^Rxt6gt-W`-Q+ufDLY15IrFxx{$(g
z&S*~)C;+cC14!0d>&iV=fYp*JK!DS|b0@)9611JS&^ws+aeIbJMVa*LH~?l6>M%9a
z`1>nYgn9dn^ZJJdDp?p9AayE}WIOKK<rCEjJqUpb0P<4(x18Tq0sHHrFsMDl;%7yC
z1ymga(vJ9ccslTZ;rw12vAYBQSI+M@WB+u1pW*xI{I2*P=lB0UJpH$v-~Zq6$Nz(F
z|MT3Tb_*!Ck!s8AIG#yQodujL88Y)6J4c+}tpN)5BwM!NRJ+dRj^9htgy&NfA`~Uu
z_3gV8PYHXA&c2-KcX;~po>{bE@AH|L_aYS?I$e0W;7pK|S$C%wuygMwmMV9u)(Dz4
z0ePQt=OH!L)>2rqC6QoBBvl^mkAWuguQFUlOLdoaKr<<5MAc5v8$O{t_u()9h6rA)
zU9Z;B=b^px>o5Gg+GO@*GRW(_6`tqVA38yQ?$(KCL@n=;s}Fv8r+@ssXg4L}TGZC^
zCjPh<0pI(eLl3n4RbR9Ey<ar>&vvSLvD^CFq&UAJYX5oVFOLRXRimYZ!C>p#+fPv_
z6mx*{n;TCiRnn;bMf-YmYez=R%MEmNY@ZY-Sg!KOqOq8SZu9J{tZB1m+2I;>I;wav
zLSi>8iud@&wHB)x8J*F50(Nw4qEM}QJ8W5un<V3C;gj=QZ>(=k&rO}Ox3}j-xcTyw
zT&A{JQ4}yRDb0&+?Ww)7XLWe$*q0oFrcb#Z#LcVZ>+mEERC~UtZ)qJr4x#V1L2v42
zWJMhq)>x-f+OaU%Fd!<e&)?z3-Ap#=lG}Imw-M-Ee){+B|HqpXbvSWyw~`7sx_(_n
zh1bf1)>&N1wb6Encvz-3165=MRCQh~=htW$F#7QV(W2%sOm|!p*9{mh*W$VuzkB!x
z?~G|h^Qqo3=3VZmrL*C$D;)KkMU@v?*v^&F(PSJ}J|*75dDhoY*@zNM4&4?-L_XCz
zH&gEJN8eP8`b;x*|8(kiSIgX7xU|cn<?Ri=7+tmwjz+^_+GFnhB8GzMAT&)E!?dR0
z8QZei^T7C#v*o#ZA)I|j`S@nasfuZ&_Ed}l-f+~i@<9A>YZr0g?rL;WE)Qf}Qx!y#
zT*X&Osq$3sWnV&ViOR8oV5nysXPxs_M!t|wsX!kkrisTRpExQqI7lRy_5@$kKX}Nk
z03Hv|b#dv>HKt-(tjU*V_uvmtMy}d^=rFBd^nK!gH+{uxbzU#W^y`^9r|ivMXw5`K
zSf6MCv&~bn1aa3<tB@~J1zuUoflsY>JWnw&t95ak(8$AlHGdt_Ayb026g9TaM&Jh0
zLMf%!?su=;T=z3o;3K<ECeu9n7EKBDCi=w1`3-#O!^Lg0J=AOjziszzFhS`q4raA1
zzh_2$H04-}0H2**++JoD*1?{~JLAeVNP}-@<jw$4^5XzXK~T#d7J;E?->phpPEO7T
z1Mt^doTx?1VcKs#fFOjMCF9zc0L!7bzl<g|0~#6H-5(ANd4`vfg>NRwQ5;gX_Vb}F
z2Jdy6_~cVB*Yz=F6hv>8)acFLPF7}5D|5@$J$gNf;nW=5nAu@%ZS{|>rW%`6v7@GB
zFRGovYNu;$H80LKs9bM3r63a6GZREe@kf2Fbd=o#_x3-&3fZCT?Ci94HKNyuxS9dO
zjCjwI8|j1)&THzH)vunKNF>)~Lus$LujBPJNYm;v%|Y^1d_pO#Y`jsx8G8C8$!Ai|
z^Xkqr=_GWAw{dGeI79Cf{43JW?@O71w)ROulcx4p+6HNk9|msTnY`{Upc{X=6<5(1
zl@w#)J2ls(lw+PHn6f|G1~radQt-5E`>Ye0Ku!=#h_J#IojS#60>Vdq*0VsasZX_~
zt(T+d76%GrSc~*8%gME^l$G!v7tE;?4W!UyBMjqO!WkL*OynD-N*~V%!2j<oZzTcb
zvl8Ib!09)y96=P^jj^txnc!8;-Lc!yH~X@z+hSmzsX;Q~c7$j)Bn=cAX6b63SM|~j
zsuSo&J{aWOayA$Y*lDt%=-jY*;gMX=ig2a!97D&L^<ny9BYq1asz{dsOBE4HvSjK=
z1_&;BHF)yH7{A)pfxNp+iL>p3<b``&_^2A0hmT6M$dx`N_PFbo=tpc*QtY4k+I53A
zC~ZsbflU*kv>l)VZSPGDuJ^=Jq?Wlk_W@Oy^jH@idBww#L%l-?2w%DiMz1G`IM({i
z!D)=2TYC*<>rw@CAcV1WPBKx-!~9E0bBIRE48v0zNRTaAT|*hV!?>f*mvgU*JB4;+
zdKtwKIb34pdF@jBT%?S;FLT38)X9ytRWNbgt(S?ByGO|;E2iwdsr7NIA5Q0qBZS^p
zW?Ke*wEs<dx67hH_gTax!zCP))Y<gBv2Rm}H6tRNI%lQK>T$8<TO5;HUvIB;a|g#8
zNt*<#=igN2olt`YPvBsRJd@ntKscK{VLH!M{7{)ZHDJUlLD~<V3`(;ek9+?<wx~P|
z@hEOW50IdHjLLMI_x;R2o2Ap=u4ZanSRk!0j3&ODq1))aaem1jX|Lta7)t4!t{w(V
znYps;9~|0Vz1>HN7~Q+~H4~n1IX;2WgYJ=IQ|U}A9E5#6V?smJpDV}cq2G#vUD7uw
z8{A%{EvxnfbH~DxMO#=AQw;ZuO|;%~2q!k$2t}?}duMHK`pLremTpbb{4FQ=b5YQy
zWL#x{$q;1F9Qmk(7#A9s`l2tcO#XL!9S4%S^2&0oq)gsKWtKERH<E2mhTB^lSo<i`
z?zs0XUff;52W|6Q)jhc^7|AXicEhBouGNm}YcZH*7zC>)^*C<btupcPxt&ogHD@p&
zS|?O}|HswC9IN~!_u%iX#C3v2Bxb{{-~3R#{tp4&!Or*6cdN@zt5*#bAa5`9ZYIsl
zoJ*<kr-@4s@otz{wia_xC<1VjZ?B7DIj1Knl}3veE9?hb>{j-#qCg=-oma&I&icAP
zS9^X&*dZAhj5qpmAo&6|5>I3hv*vRF(sg-n7V4}*le3M@$Gwgz;C1-Oh6Hfot75jB
z6Y_5vZDX#<IT{w6pMV`vQF0XDSCumV7S+tO)P_CM^p{%v9JMLaj(|e1M90K<ldlw*
zA=#GX-CxTMCrlGb!QU48oK4T7Oo1v3V}I2lpYs7b-=kAZ@WsqFzjd^V-UQsr=XM0q
z#3Mn|lXLBHif9g>SuGSF$ob}dQ5*f~_sI%w)Iu5!?hT~n=7EoQgUq;Z^^YJI2Gv&}
zkTFS3&8Bul!T9Njp{}aa96U*F%O{p;qwfP<6`nI%bJ3H-w{cBlTAP3XLZoAEX1~or
z<CjTM$do|sH*3Gr9KT8Obc?}y?)ZeyG9-g{^%@14H=y0=o!+8Dp{kULUDUwP)M;^o
zEN$;&iDaSuk#c*MYD?~PW(aX-;Ih1Yx69Bb^lrn1SI+~+@3^xV_o^IRB=^eH!5fCa
zuQ_%qfg>GU4bOH!qaQ!1YJo=8IajXF1W%G}(h_zugdBx2k_}Kqn+JajE9a8*efxv<
z7}4o|UrT#Tpq-1$g{3+12+`M&qeCic+ODQUs+-c#!!z!Y*3Z0W@o{&$Q&1EJ#S7e%
z81EG+P;s5ljAqQ|8>l1!`Ha6Oj6c#%HCA@phsC39eO2p+{qXtAu&GYV{1@J$5T}5S
zozi()yQ2`H&7(h>s!s(Z2q7minV7-?m9)K6rktV0JLg}1$}=-g6t;^OQk@K%Vp08L
zDqb;il=GzQy|XbB=cEKXyE-p7jcOcfsgJzAa(jm_COVoia^SFv$OrU}SNg77xHi*L
zebBDJFg9%F9LlZ`c=Qb=+4)QL!;m-M=B6UE@8I9ex_ORQW)2QxJ1QD6&ttrr^g>J|
z3OBkY*ASN+*y8ueaK5bi@?!BHnG3KgemmrE^UfTTb(YGJTVvr>jGgP^&g{1kj`QCX
zx&3ZcDvfr-a{aG6gFiD6H7^d}ZIHMItJbaKHO;sXlDN-*umv3q>X<QWQKOT~SB;9T
zs>E~>A&=JuXzIi>5kNAsXEm5W%%JWf@E~XXJS>p4oi1muz-&O1n4x%3K{b)Ub<|7d
zQ{GNxZ1!_!Zdp+xmdJRgR^A1FV)lqjc@@f%te~~_K6oIUBl$qmj4wPs{+xgG`B3<1
z*~`hGM~#1=Lh`+5?#qinpa{C<1DX!Gj=85T-}VVLuJ|Yo>IL<>yLlca4d__6@#dAG
z5@~BZ{Ay#zi46{R-SL2pDf{vxBLZpCQ{VJ#DUEuRQ+nWIhG?#}{6y<KBNU~3rQcHx
z{$xv4kh{(?Sy;v;TMrM3h_sh4DIk!oj6m_?l_7#8I!(EYA6SPkiZph1GV)}EStq5e
zY>-Nnub8XUh`F-@3q&M_#A0V%D-*LLm=k<3)225s^QLPfX(r<Jr|uk&M!9F&+UuOs
zr&6z#g%s68J<=-s`|opdaW%BIt|z>C!Exf^MYye}r}_6U<7ukFu`@FfqW7}5_2iDW
zWQ*b>;6M)a`zVQZB02sdxxMQFe^xf76vf%sG9yN%D#xW6Wlz%5_?1;uxW<+qvJ=G6
z!5dRF?#q__C06lT8w4)mnKkUZlzqP`KjC2JIp6m&goI|rcqZH}wlB_SHfZpUa{{v_
z9XG<91f+%#w6y#&QS@V^h1_86$zQkb*Yoq{%d8jU`RtTnB7eiUoA_l(Qm-j;dZq?z
zJBSu`Rb=zhkG~@=bH%75Cz6fqg-CZr0=ocKb`<mI6w&pdzvlw^@&h&SB}V#&*xjJb
zDj>%>&3@)Xd58HH41B=N$z2`b7?`dseZcz5Iqe^v+JmYMK4JegRLunX+YSZrcS}oO
Kv*?Cx=zjr;x-ZTE


From 323919aba76d3e265ac8534fadc3bd7200443bca Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 11:58:03 +0200
Subject: [PATCH 15/28] Clean up resources removing previous tasks code.
 https://github.com/solo-io/workshops/pull/69\#issuecomment-885498960

---
 gloo-edge/gloo-edge/README.md | 121 ++++------------------------------
 1 file changed, 12 insertions(+), 109 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 31dbc9a52c..6724d007f9 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -931,13 +931,6 @@ spec:
     domains:
       - '*'
     options:
-      ratelimitBasic:
-        anonymousLimits:
-          requestsPerUnit: 5
-          unit: MINUTE
-        authorizedLimits:
-          requestsPerUnit: 20
-          unit: MINUTE
 # ---------------- Web Application Firewall -----------
       waf:
         customInterventionMessage: "Payload sizes above 1KB not allowed"
@@ -1008,13 +1001,6 @@ spec:
     domains:
       - '*'
     options:
-      ratelimitBasic:
-        anonymousLimits:
-          requestsPerUnit: 5
-          unit: MINUTE
-        authorizedLimits:
-          requestsPerUnit: 20
-          unit: MINUTE
 # -------- Web Application Firewall - Check User-Agent  -----------
       waf:
         customInterventionMessage: "Blocked Scammer"
@@ -1193,18 +1179,6 @@ spec:
         prefixRewrite: '/'
         stagedTransformations:
           early:
-            responseTransforms:
-            - responseTransformation:
-                transformationTemplate:
-                  parseBodyBehavior: DontParse
-                  headers:
-                    Content-type: 
-                      text: "application/json"
-                  body:
-                      text: |
-                            {% if header(":status") == "401" %} 
-                            Hold the horses! You are not authenticated
-                            {% else %}{{ body() }}{% endif %}
 # ---------------- Transformation with regex ------------------   
             requestTransforms:       
             - requestTransformation:
@@ -1279,19 +1253,6 @@ spec:
     domains:
       - '*'
     options:
-      ratelimitBasic:
-        anonymousLimits:
-          requestsPerUnit: 5
-          unit: MINUTE
-        authorizedLimits:
-          requestsPerUnit: 20
-          unit: MINUTE
-      waf:
-        customInterventionMessage: "Blocked Scammer"
-        ruleSets:
-        - ruleStr: |
-            SecRuleEngine On
-            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
 #--------------Extract claims-----------------
       jwt:
         providers:
@@ -1330,18 +1291,10 @@ spec:
               name: oauth
               namespace: gloo-system
         routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
 EOF
 ```
 
@@ -1404,19 +1357,6 @@ spec:
     domains:
       - '*'
     options:
-      ratelimitBasic:
-        anonymousLimits:
-          requestsPerUnit: 5
-          unit: MINUTE
-        authorizedLimits:
-          requestsPerUnit: 20
-          unit: MINUTE
-      waf:
-        customInterventionMessage: "Blocked Scammer"
-        ruleSets:
-        - ruleStr: |
-            SecRuleEngine On
-            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
       jwt:
         providers:
           keycloak:
@@ -1470,18 +1410,10 @@ spec:
               name: oauth
               namespace: gloo-system
         routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
 EOF
 ```
 
@@ -1586,19 +1518,6 @@ spec:
     domains:
       - '*'
     options:
-      ratelimitBasic:
-        anonymousLimits:
-          requestsPerUnit: 5
-          unit: MINUTE
-        authorizedLimits:
-          requestsPerUnit: 20
-          unit: MINUTE
-      waf:
-        customInterventionMessage: "Blocked Scammer"
-        ruleSets:
-        - ruleStr: |
-            SecRuleEngine On
-            SecRule REQUEST_HEADERS:User-Agent "scammer" "deny,status:403,id:107,phase:1,msg:'blocked scammer'"
       jwt:
         providers:
           keycloak:
@@ -1618,10 +1537,6 @@ spec:
                 upstreamRef:
                   name: default-keycloak-8080
                   namespace: gloo-system
-#-------------- RBAC is disabled to not interfere with OPA ------------------
-      rbac:
-        disable: true
-#-------------------------------------------------------------------------- 
     routes:
       - matchers:
           - prefix: /not-secured
@@ -1634,27 +1549,15 @@ spec:
       - matchers:
           - prefix: /
         options:
-#-------------- RBAC is disabled to not interfere with OPA ------------------
-          rbac:
-            disable: true
-#------------------------------------------------------------------------
           extauth:
             configRef:
               name: oauth
               namespace: gloo-system
         routeAction:
-            multi:
-                destinations:
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-productpage-9080
-                          namespace: gloo-system
-                - weight: 5
-                  destination:
-                      upstream:
-                          name: bookinfo-beta-productpage-9080
-                          namespace: gloo-system
+          single:
+            upstream:
+              name: bookinfo-productpage-9080
+              namespace: gloo-system
 EOF
 ```
 

From 6411e9c995d83759a2ec76f6b11aa244b3253a22 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 13:55:43 +0200
Subject: [PATCH 16/28] fix task

---
 gloo-edge/gloo-edge/README.md | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 6724d007f9..88b893b6fb 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1072,6 +1072,15 @@ spec:
         - prefix: /not-secured
       options:
         prefixRewrite: '/'
+# -------- Rate limit config by authenticated and anonymous -------
+        ratelimitBasic:
+          anonymousLimits:
+            requestsPerUnit: 5
+            unit: MINUTE
+          authorizedLimits:
+            requestsPerUnit: 20
+            unit: MINUTE
+# -----------------------------------------------------------------
 # ---------------- Transformation ------------------          
         transformations:
           responseTransformation:
@@ -1091,7 +1100,7 @@ EOF
 Refreshing your browser more than 5 times, you should be able to see a styled HTML page indicating that you have reached the limit you had configured before. 
 
 ```
-/opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/get
+/opt/google/chrome/chrome $(glooctl proxy url --port https)/productpage
 ```
 
 ### Manipulate the response when a 401 Not Authorized is returned

From ec4d1365f7cc61646933417125f429a253683558 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 14:57:23 +0200
Subject: [PATCH 17/28] fix task

---
 gloo-edge/gloo-edge/README.md | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 88b893b6fb..81a15c07ce 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1068,7 +1068,10 @@ metadata:
     application-owner: team1
 spec:
   routes:
-    - matchers:
+# -------- Rate limit at route level requires to give a name -------
+    - name: "not-secured"
+# ------------------------------------------------------------------
+      matchers:
         - prefix: /not-secured
       options:
         prefixRewrite: '/'

From 454c88550a4e9158f510d646e8dc4c5c86d2e2e0 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 14:58:27 +0200
Subject: [PATCH 18/28] fix task

---
 gloo-edge/gloo-edge/README.md | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 81a15c07ce..eba5fbf95c 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1075,15 +1075,12 @@ spec:
         - prefix: /not-secured
       options:
         prefixRewrite: '/'
-# -------- Rate limit config by authenticated and anonymous -------
+# -------- Rate limit as you saw before ------------
         ratelimitBasic:
           anonymousLimits:
             requestsPerUnit: 5
             unit: MINUTE
-          authorizedLimits:
-            requestsPerUnit: 20
-            unit: MINUTE
-# -----------------------------------------------------------------
+# --------------------------------------------------
 # ---------------- Transformation ------------------          
         transformations:
           responseTransformation:

From 7f622930df361e439ecea49597b6f4993dc02823 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 14:59:51 +0200
Subject: [PATCH 19/28] fix task tranform body

---
 gloo-edge/gloo-edge/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index eba5fbf95c..9546c27d86 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1100,7 +1100,7 @@ EOF
 Refreshing your browser more than 5 times, you should be able to see a styled HTML page indicating that you have reached the limit you had configured before. 
 
 ```
-/opt/google/chrome/chrome $(glooctl proxy url --port https)/productpage
+/opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/get
 ```
 
 ### Manipulate the response when a 401 Not Authorized is returned

From 2f25bcaa7bb49af2c9c6339d2a601dcda5e7d97f Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 15:03:32 +0200
Subject: [PATCH 20/28] fix wrong endpoint

---
 gloo-edge/gloo-edge/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 9546c27d86..9d684b12fc 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1164,7 +1164,7 @@ curl -v -k $(glooctl proxy url --port https)/not-secured/status/401
 And any other status code, returns the expected body:
 
 ```
-curl -v -k $(glooctl proxy url --port https)/not-secured/status/get
+curl -v -k $(glooctl proxy url --port https)/not-secured/status/200
 ```
 
 ### Early response transformation

From 7170a1c5ee637bdfaf083e366f91048adca49397 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 15:08:45 +0200
Subject: [PATCH 21/28] fix missing https protocol

---
 gloo-edge/gloo-edge/README.md | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 9d684b12fc..3241718b00 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1310,13 +1310,13 @@ EOF
 Once again, you need to refresh your **bookinfo** application to refresh the token in case it expires.
 
 ```
-/opt/google/chrome/chrome $(glooctl proxy url)/productpage
+/opt/google/chrome/chrome $(glooctl proxy url --port https)/productpage
 ```
 
 And now, let's see the results with the fresh token:
 
 ```
-/opt/google/chrome/chrome $(glooctl proxy url)/not-secured/get
+/opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/get
 ```
 
 Here is the output you should get if you refresh the web page:
@@ -1437,11 +1437,11 @@ RBAC: access denied
 Let's compare:
 
 ```
-/opt/google/chrome/chrome $(glooctl proxy url)/not-secured/get
+/opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/get
 ```
 
 ```
-/opt/google/chrome/chrome $(glooctl proxy url)/not-secured/anything
+/opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/anything
 ```
 
 

From b130d622f96532a91ed47c1b969669cf0c6c6b65 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 15:29:43 +0200
Subject: [PATCH 22/28] Add authconfig token to header

---
 gloo-edge/gloo-edge/README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 3241718b00..5031792319 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -681,6 +681,8 @@ spec:
         issuerUrl: "${KEYCLOAK_URL}/realms/master/"
         scopes:
         - email
+        headers:
+          idTokenHeader: jwt
 EOF
 ```
 

From f3d7286e50e433f6b30c35730fa425b1e15378d1 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 15:43:52 +0200
Subject: [PATCH 23/28] Fix task regarding claims extraction

---
 gloo-edge/gloo-edge/README.md | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 5031792319..b4f60b5126 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1248,6 +1248,8 @@ KEYCLOAK_MASTER_REALM_URL=http://$(kubectl get svc keycloak -ojsonpath='{.status
 
 Now, you can update the resources to validate the token, extract claims from the token and create new headers based on these claims.
 
+Notice that you will move the `extauth` block to a global location in the resource so that it affects all routes. You want to test this with **httpbin**.
+
 ```bash
 kubectl apply -f - <<EOF
 apiVersion: gateway.solo.io/v1
@@ -1264,6 +1266,12 @@ spec:
     domains:
       - '*'
     options:
+#-------------- Moved from specific route to a global place -----------------    
+      extauth:
+        configRef:
+          name: oauth
+          namespace: gloo-system
+#----------------------------------------------------------------------------
 #--------------Extract claims-----------------
       jwt:
         providers:
@@ -1296,11 +1304,6 @@ spec:
               application-owner: team1
       - matchers:
           - prefix: /
-        options:
-          extauth:
-            configRef:
-              name: oauth
-              namespace: gloo-system
         routeAction:
           single:
             upstream:

From f84d47720951bc553d1a752fae00688c86a2c2bd Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 15:46:09 +0200
Subject: [PATCH 24/28] Add oauth2 header to authconfig

---
 gloo-edge/gloo-edge/README.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index b4f60b5126..75288585dd 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1479,6 +1479,8 @@ spec:
         issuerUrl: "${KEYCLOAK_URL}/realms/master/"
         scopes:
         - email
+        headers:
+          idTokenHeader: jwt
   - opaAuth:
       modules:
       - name: allow-solo-email-users

From eaaf385cc9ce9124454b19760ba331ca155a4acd Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 16:05:05 +0200
Subject: [PATCH 25/28] Delete native RBAC

---
 gloo-edge/gloo-edge/README.md | 110 +---------------------------------
 1 file changed, 1 insertion(+), 109 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 75288585dd..1c3a87100d 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1343,115 +1343,7 @@ As you can see, Gloo Edge has added the `x-solo-claim-email` and `x-solo-claim-e
 
 It will allow the application to know the user's email identity and if that email has been verified.
 
-## Lab 6: Authorization
-
-Gloo can also integrate with different mechanisms to provide Authorization level.
-
-### RBAC using the claims of the JWT token
-
-You can set RBAC rules based on the claims of the JWT token returned by the identity provider.
-
-In the following example, you are going to configure RBAC policies for all routes. But you are going to disable it for the **bookinfo** application.
-
-Thus, the RBAC policies will be applied to the **httpbin** application.
-
-```bash
-kubectl apply -f - <<EOF
-apiVersion: gateway.solo.io/v1
-kind: VirtualService
-metadata:
-  name: demo
-  namespace: gloo-system
-spec:
-  sslConfig:
-    secretRef:
-      name: upstream-tls
-      namespace: gloo-system  
-  virtualHost:
-    domains:
-      - '*'
-    options:
-      jwt:
-        providers:
-          keycloak:
-            issuer: ${KEYCLOAK_MASTER_REALM_URL}
-            keepToken: true
-            tokenSource:
-              headers:
-              - header: jwt
-            claimsToHeaders:
-            - claim: email
-              header: x-solo-claim-email
-            - claim: email_verified
-              header: x-solo-claim-email-verified
-            jwks:
-              remote:
-                url: http://keycloak.default.svc:8080/auth/realms/master/protocol/openid-connect/certs
-                upstreamRef:
-                  name: default-keycloak-8080
-                  namespace: gloo-system
-#-------------- Add RBAC rule for all routes ------------------
-      rbac:
-        policies:
-          viewer:
-            permissions:
-              methods:
-              - GET
-              pathPrefix: /not-secured/get
-            principals:
-            - jwtPrincipal:
-                claims:
-                  email: user1@solo.io
-#----------------------------------------------- 
-    routes:
-      - matchers:
-          - prefix: /not-secured
-        delegateAction:
-          selector:
-            namespaces:
-              - team1
-            labels:
-              application-owner: team1
-      - matchers:
-          - prefix: /
-        options:
-#-------------- Disable RBAC for this route ------------------
-          rbac:
-            disable: true
-#-------------------------------------------------------------
-          extauth:
-            configRef:
-              name: oauth
-              namespace: gloo-system
-        routeAction:
-          single:
-            upstream:
-              name: bookinfo-productpage-9080
-              namespace: gloo-system
-EOF
-```
-
-If you refresh the **bookinfo** web page, you should still get the same response you got before.
-
-But if you access the **httpbin** and change the path to anything that doesn't start with `/not-secured/get`, you should get the following response.
-
-```
-RBAC: access denied
-```
-
-Let's compare:
-
-```
-/opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/get
-```
-
-```
-/opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/anything
-```
-
-
-
-### RBAC using OPA
+## Lab 6: Authorization with OPA
 
 Gloo Edge can also be used to set RBAC rules based on [OPA (Open Policy Agent)](https://www.openpolicyagent.org/) and its rego rules.
 

From 28a0df641c9a906efe63bf545c21ae6ad5d96aa0 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 16:12:30 +0200
Subject: [PATCH 26/28] Remove not existing 429 error

---
 gloo-edge/gloo-edge/README.md | 16 +---------------
 1 file changed, 1 insertion(+), 15 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 1c3a87100d..9b305da87c 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -1587,7 +1587,7 @@ Check the access logs running the following command:
 kubectl logs -n gloo-system deployment/gateway-proxy | grep '^{' | jq
 ```
 
-If you refresh the browser to send additional requests until the rate limiting threshold is exceeded, then you will see both `200 OK` and `429 Too Many Requests` responses in the access logs, as in the example below.
+If you refresh the browser to send additional requests, then you will see both `200 OK` responses in the access logs, as in the example below.
 
 ```
 {
@@ -1604,20 +1604,6 @@ If you refresh the browser to send additional requests until the rate limiting t
   "upstreamName": "bookinfo-beta-productpage-9080_gloo-system",
   "responseCode": 200
 }
-{
-  "httpMethod": "GET",
-  "systemTime": "2020-10-22T21:38:19.168Z",
-  "targetDuration": null,
-  "path": "/productpage",
-  "protocol": "HTTP/2",
-  "responseFlags": "-",
-  "clientDuration": 3,
-  "number": null,
-  "responseCode": 429,
-  "upstreamName": null,
-  "messageType": null,
-  "requestId": "494c3cc7-e476-4414-8c50-499f3619f84c"
-}
 ```
 
 These logs can now be collected by the Log aggregator agents and potentially forwarded to your favorite enterprise logging service. 

From a11f446edd16c255609447537c33425acd1989d5 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Fri, 23 Jul 2021 16:16:02 +0200
Subject: [PATCH 27/28] Remove reference of RBAC in the summary

---
 gloo-edge/gloo-edge/README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index 9b305da87c..fae25fc7a3 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -16,7 +16,7 @@ In this workshop we will:
 * Rate limit the traffic going to the apps
 * Apply rules for the Web Application Firewall (WAF)
 * Transform requests, responses and bodies using Gloo transformations
-* Apply Authorization using RBAC and OPA (Open Policy Agent)
+* Apply Authorization OPA (Open Policy Agent)
 * Configure access logs
 
 ## Lab 0: Demo Environment Creation

From bbcc5692389ab21b71130eba24915053d8bb3c94 Mon Sep 17 00:00:00 2001
From: Antonio Berben <a.berben.m@gmail.com>
Date: Mon, 26 Jul 2021 10:19:37 +0200
Subject: [PATCH 28/28] Add for loop

---
 gloo-edge/gloo-edge/README.md | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/gloo-edge/gloo-edge/README.md b/gloo-edge/gloo-edge/README.md
index fae25fc7a3..a2b8f667c2 100644
--- a/gloo-edge/gloo-edge/README.md
+++ b/gloo-edge/gloo-edge/README.md
@@ -893,10 +893,13 @@ spec:
 EOF
 ```
 
-Refresh the **httpbin** application and after 5 times, you will retrieve a **429 error**. This is because you are an anonymous user.
+Access the **httpbin** application 10 times. After reaching the Rate Limit, you will retrieve a **429 error**. This is because you are an anonymous user in that application.
 
 ```
-/opt/google/chrome/chrome $(glooctl proxy url --port https)/not-secured/get
+for i in {1..10}
+do
+curl -k -s -o /dev/null -w "%{http_code}" $(glooctl proxy url --port https)/not-secured/get; echo
+done
 ```
 
 Now, try it with the **bookinfo** application, and the number of requests will be limited to 20 as you are an Authenticated user.