From f6b9ab0dde3d7aa9013af250a06b770ac95f0281 Mon Sep 17 00:00:00 2001 From: Carlos Sanchez Date: Sun, 14 Nov 2004 21:53:28 +0000 Subject: [PATCH] Moved to doc subproject --- docs/.cvsignore | 2 - docs/reference/.cvsignore | 5 - docs/reference/README | 25 - docs/reference/images/admons/blank.png | Bin 374 -> 0 bytes docs/reference/images/admons/caution.gif | Bin 743 -> 0 bytes docs/reference/images/admons/caution.png | Bin 1250 -> 0 bytes docs/reference/images/admons/caution.tif | Bin 1978 -> 0 bytes docs/reference/images/admons/draft.png | Bin 17454 -> 0 bytes docs/reference/images/admons/home.gif | Bin 321 -> 0 bytes docs/reference/images/admons/home.png | Bin 1156 -> 0 bytes docs/reference/images/admons/important.gif | Bin 1003 -> 0 bytes docs/reference/images/admons/important.png | Bin 722 -> 0 bytes docs/reference/images/admons/important.tif | Bin 2020 -> 0 bytes docs/reference/images/admons/next.gif | Bin 1083 -> 0 bytes docs/reference/images/admons/next.png | Bin 1150 -> 0 bytes docs/reference/images/admons/note.gif | Bin 580 -> 0 bytes docs/reference/images/admons/note.png | Bin 490 -> 0 bytes docs/reference/images/admons/note.tif | Bin 460 -> 0 bytes docs/reference/images/admons/prev.gif | Bin 1118 -> 0 bytes docs/reference/images/admons/prev.png | Bin 1132 -> 0 bytes docs/reference/images/admons/tip.gif | Bin 598 -> 0 bytes docs/reference/images/admons/tip.png | Bin 449 -> 0 bytes docs/reference/images/admons/tip.tif | Bin 420 -> 0 bytes docs/reference/images/admons/toc-blank.png | Bin 318 -> 0 bytes docs/reference/images/admons/toc-minus.png | Bin 259 -> 0 bytes docs/reference/images/admons/toc-plus.png | Bin 264 -> 0 bytes docs/reference/images/admons/up.gif | Bin 1089 -> 0 bytes docs/reference/images/admons/up.png | Bin 1111 -> 0 bytes docs/reference/images/admons/warning.gif | Bin 743 -> 0 bytes docs/reference/images/admons/warning.png | Bin 1241 -> 0 bytes docs/reference/images/admons/warning.tif | Bin 1990 -> 0 bytes docs/reference/images/callouts/1.gif | Bin 968 -> 0 bytes docs/reference/images/callouts/1.png | Bin 329 -> 0 bytes docs/reference/images/callouts/10.gif | Bin 968 -> 0 bytes docs/reference/images/callouts/10.png | Bin 361 -> 0 bytes docs/reference/images/callouts/11.gif | Bin 244 -> 0 bytes docs/reference/images/callouts/11.png | Bin 565 -> 0 bytes docs/reference/images/callouts/12.gif | Bin 244 -> 0 bytes docs/reference/images/callouts/12.png | Bin 617 -> 0 bytes docs/reference/images/callouts/13.gif | Bin 244 -> 0 bytes docs/reference/images/callouts/13.png | Bin 623 -> 0 bytes docs/reference/images/callouts/14.gif | Bin 244 -> 0 bytes docs/reference/images/callouts/14.png | Bin 411 -> 0 bytes docs/reference/images/callouts/15.gif | Bin 244 -> 0 bytes docs/reference/images/callouts/15.png | Bin 640 -> 0 bytes docs/reference/images/callouts/2.gif | Bin 968 -> 0 bytes docs/reference/images/callouts/2.png | Bin 353 -> 0 bytes docs/reference/images/callouts/3.gif | Bin 968 -> 0 bytes docs/reference/images/callouts/3.png | Bin 350 -> 0 bytes docs/reference/images/callouts/4.gif | Bin 968 -> 0 bytes docs/reference/images/callouts/4.png | Bin 345 -> 0 bytes docs/reference/images/callouts/5.gif | Bin 968 -> 0 bytes docs/reference/images/callouts/5.png | Bin 348 -> 0 bytes docs/reference/images/callouts/6.gif | Bin 968 -> 0 bytes docs/reference/images/callouts/6.png | Bin 355 -> 0 bytes docs/reference/images/callouts/7.gif | Bin 968 -> 0 bytes docs/reference/images/callouts/7.png | Bin 344 -> 0 bytes docs/reference/images/callouts/8.gif | Bin 968 -> 0 bytes docs/reference/images/callouts/8.png | Bin 357 -> 0 bytes docs/reference/images/callouts/9.gif | Bin 968 -> 0 bytes docs/reference/images/callouts/9.png | Bin 357 -> 0 bytes docs/reference/src/images/logo.gif | Bin 22790 -> 0 bytes docs/reference/src/images/logo.psd | Bin 260081 -> 0 bytes docs/reference/src/index.xml | 4015 -------------------- docs/reference/styles/fopdf.xsl | 488 --- docs/reference/styles/html.css | 168 - docs/reference/styles/html.xsl | 94 - docs/reference/styles/html_chunk.xsl | 96 - 68 files changed, 4893 deletions(-) delete mode 100644 docs/.cvsignore delete mode 100644 docs/reference/.cvsignore delete mode 100644 docs/reference/README delete mode 100644 docs/reference/images/admons/blank.png delete mode 100644 docs/reference/images/admons/caution.gif delete mode 100644 docs/reference/images/admons/caution.png delete mode 100644 docs/reference/images/admons/caution.tif delete mode 100644 docs/reference/images/admons/draft.png delete mode 100644 docs/reference/images/admons/home.gif delete mode 100644 docs/reference/images/admons/home.png delete mode 100644 docs/reference/images/admons/important.gif delete mode 100644 docs/reference/images/admons/important.png delete mode 100644 docs/reference/images/admons/important.tif delete mode 100644 docs/reference/images/admons/next.gif delete mode 100644 docs/reference/images/admons/next.png delete mode 100644 docs/reference/images/admons/note.gif delete mode 100644 docs/reference/images/admons/note.png delete mode 100644 docs/reference/images/admons/note.tif delete mode 100644 docs/reference/images/admons/prev.gif delete mode 100644 docs/reference/images/admons/prev.png delete mode 100644 docs/reference/images/admons/tip.gif delete mode 100644 docs/reference/images/admons/tip.png delete mode 100644 docs/reference/images/admons/tip.tif delete mode 100644 docs/reference/images/admons/toc-blank.png delete mode 100644 docs/reference/images/admons/toc-minus.png delete mode 100644 docs/reference/images/admons/toc-plus.png delete mode 100644 docs/reference/images/admons/up.gif delete mode 100644 docs/reference/images/admons/up.png delete mode 100644 docs/reference/images/admons/warning.gif delete mode 100644 docs/reference/images/admons/warning.png delete mode 100644 docs/reference/images/admons/warning.tif delete mode 100644 docs/reference/images/callouts/1.gif delete mode 100644 docs/reference/images/callouts/1.png delete mode 100644 docs/reference/images/callouts/10.gif delete mode 100644 docs/reference/images/callouts/10.png delete mode 100644 docs/reference/images/callouts/11.gif delete mode 100644 docs/reference/images/callouts/11.png delete mode 100644 docs/reference/images/callouts/12.gif delete mode 100644 docs/reference/images/callouts/12.png delete mode 100644 docs/reference/images/callouts/13.gif delete mode 100644 docs/reference/images/callouts/13.png delete mode 100644 docs/reference/images/callouts/14.gif delete mode 100644 docs/reference/images/callouts/14.png delete mode 100644 docs/reference/images/callouts/15.gif delete mode 100644 docs/reference/images/callouts/15.png delete mode 100644 docs/reference/images/callouts/2.gif delete mode 100644 docs/reference/images/callouts/2.png delete mode 100644 docs/reference/images/callouts/3.gif delete mode 100644 docs/reference/images/callouts/3.png delete mode 100644 docs/reference/images/callouts/4.gif delete mode 100644 docs/reference/images/callouts/4.png delete mode 100644 docs/reference/images/callouts/5.gif delete mode 100644 docs/reference/images/callouts/5.png delete mode 100644 docs/reference/images/callouts/6.gif delete mode 100644 docs/reference/images/callouts/6.png delete mode 100644 docs/reference/images/callouts/7.gif delete mode 100644 docs/reference/images/callouts/7.png delete mode 100644 docs/reference/images/callouts/8.gif delete mode 100644 docs/reference/images/callouts/8.png delete mode 100644 docs/reference/images/callouts/9.gif delete mode 100644 docs/reference/images/callouts/9.png delete mode 100644 docs/reference/src/images/logo.gif delete mode 100644 docs/reference/src/images/logo.psd delete mode 100644 docs/reference/src/index.xml delete mode 100644 docs/reference/styles/fopdf.xsl delete mode 100644 docs/reference/styles/html.css delete mode 100644 docs/reference/styles/html.xsl delete mode 100644 docs/reference/styles/html_chunk.xsl diff --git a/docs/.cvsignore b/docs/.cvsignore deleted file mode 100644 index a8f46ee569..0000000000 --- a/docs/.cvsignore +++ /dev/null @@ -1,2 +0,0 @@ -api - diff --git a/docs/reference/.cvsignore b/docs/reference/.cvsignore deleted file mode 100644 index c8e2b9d580..0000000000 --- a/docs/reference/.cvsignore +++ /dev/null @@ -1,5 +0,0 @@ -lib -html -html_single -pdf - diff --git a/docs/reference/README b/docs/reference/README deleted file mode 100644 index b502b2766b..0000000000 --- a/docs/reference/README +++ /dev/null @@ -1,25 +0,0 @@ -We're using the DocBook XSL distribution for HTML and PDF -generation. The best results can be achieved with the -Saxon XSLT processor (don't use Xalan!) and the Apache -FOP library. - -The documentation is generated by the build.xml file of -Spring and Ant. Targets included are: - -- docpdf - generates the PDF documentation -- dochtml - generates the HTML documentation -- dochtmlsingle - generates single page HTML documenation -- docclean - clean any output directories for docs - -To generate documentation, you need to include a lot -of libraries, which haven't been added to CVS because -they're simply too big. The libraries can be found at: -http://www.jteam.nl/spring/reference-libraries.zip. -Download them, create a lib directory in the -docs/reference directory and unzip the zip there. -Then, the targets should work. - -Thanks to Hibernate, for providing the skeleton for -DocBook documentation! - -alef@jteam.nl diff --git a/docs/reference/images/admons/blank.png b/docs/reference/images/admons/blank.png deleted file mode 100644 index 764bf4f0c3bb4a09960b04b6fa9c9024bca703bc..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 374 zcmeAS@N?(olHy`uVBq!ia0vp^4Is?H1SEZ8zRdwrEa{HEjtmSN`?>!lvNA9*>Uz33 zhE&XXd(lylL4oIh!GZnHecj|txT>yO8>^qY%(y?B;Tppl#t7yOYze#vq#8^aMzDZb YLK^d5CO(feU_df>y85}Sb4q9e0Be`**{8_ndlqdgjcTGH1@5rAvWm>DH}V&z(E>{Q2|u@89nQ znoBxR{K>+|z@W#V1JVle69d~nhv}!E7VV7D!$l=+#gyARX+eW7x`wT@Cg?1ihH6;1 zs$!+xj1Yt%W31lvY*ooh8##Wqt4P*f&)W2{!b0}^@kv>5x2zLQef-gZgT0SEg>hLF z)Pd`+x;*(#oF^Yc1wYmptOPqEY|_Nz%wH;O`WPI6ayD{2tAO4N zo7{UG#GByI2%_fo|5LqMv{6N+A1o@_2o{w)&t4I@GfML`SWvEy;UY+Xf4Xzz&KO;h zV_?(HH9iCh`e$qcdSYD|*JluqH{jv}kl>0fV4tmS-PB+scb>_h18CFP6lf@4^@?vqT-$&hMpcE*)wGd!;~q-Q>IkUnZqz=PVt;M zK*p3gbLK2v%CK~4^3tV1#?q}@8MbbX+PXD)>(;G%_cH9=n|$sZ!?|yxmE{-7;w@N47?rU=3X_NkV zU|o{PnRTZ;lXp4>+)hZU_|Lw%*va*6=<@jI@BP^`_OsZ?pZg-2AaGf|;i2L0<>du@ zeRrO4er03}pLSxdREd>pap^;~&E+}=JYKy#vHnLI=Z$}pPyA_`zG;G~<$`Br2do;7 z$Heivv0AeyJYVI({@6?X6r+V~XS2Cs!|bddDqJz@2lKf$~4dA1c%lfOT+5KMUSWi#X5(9ePxx_W1Bsf2+N)z4*}Q$iB}K{RAP diff --git a/docs/reference/images/admons/caution.tif b/docs/reference/images/admons/caution.tif deleted file mode 100644 index 4a282948c4c7ed53a2cab4132152c9923f7eb363..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1978 zcmebD)MDUaXJBaHTM%HOBF4+!!hOu3BSpZ2m-o=a4UGyOVRGC@78N*Fn1mTgu^*ne z;*L$0(G;HMj}kXtX=zR2W)oug(x;}vd4|pLf`&qbk&JK3goqWpg18tM4sYt>NNQ*5 zJO1L!te8d4X6?)=pC(QSU||)yt{QYgWZzM1M#kk|4=&{>4cy$*l3-xF?uL{AUz_5A z50}pAFgB%?DF*m>GD)-@{{F$i>YOfT;)C)He}4t3vbN+MR?Ki#WjWH`E;J#5fkSah z*CvDRdtCvNOpI%k6$_&6*{?lq*|st4mU-vV>qgQQdBM7KAGv%{?hRM3li^KVy1S9x zik*=G2sju77$g`J84MYm7@`=G8L}CQ8LAmtfUpM)r!auv95`Ic0D)T>AaF0kUWRi( zcnu8iF+kvR1_*r5@Sfp29R6n*g@Y>uM&o~Q#Rt7z11bTqgJPg?F|Y&xk=0NVR1Poz z%ZNF^GJpYGT5JXL8G!j8gs%ZfLk3G=Ndlpt1L^lb3@Tv^fu#V1MQ=Zj+J`d)yn#^y zss&&)AHzQe7O)6V5GchAW=nvWNNgr3n*%7$3}v$d*=$fYGmtIF2r&nwMieRzvPldo p4l+|5%Ki*wOEI#7?fS#Uz#t7}vjA&lTO_>>KsEyq{Q;^60RYt05`+K% diff --git a/docs/reference/images/admons/draft.png b/docs/reference/images/admons/draft.png deleted file mode 100644 index 0084708c9b8287c51efa6b40b8d492854191455e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 17454 zcmXwh2{_c>_y1e^C}m43S&}RzTQstU#!g0*n6YJ1aTS}>RLe1z8LVo z`rtm$Vp5JW1|R$HTrs@@LGR)Z?>PPkL8l=j-77Z&G8Tsi{RV4sPaGi)BBI`)`R~Q` z*=O$N8oBahuA1ujq=ONsH^Z$;Z@?A2zPOR;+t7%GvNscPQvtyu^ z^(He{(TNfAz{D>S76#pNt`V=aFm{t&tF)Lut!iq>3RU|!!{xbB|2@69Az7({KpgFX zBHUL)|7ydZKc0k%azcGA&PuCQV*kD$bT{P;b?=`M@6C_|b6!~s9j#tuU~e9n-MCHj zfV5S(js_`kv|ivaLE*6pY!G%r11u^qOVBw|g29`m16#D?@yi>zc0bwz%G@ za2kvxn$XS7{2WQ_ju!==VTs+`V&L;sVz(Pl4+J?F&ZZv3KoKW2c?bBtGq5)oRM?*)usx_-H@47Cu#_qL+2eow%ZDy0=bsNsUP&ms8wSUp@nG86W_bQDmNMRgINC`_}NgC zCcqF_Ta|ScVvPu;|0KG{NIio~DaGYcHYq4AEiIzkxEPqs@0$Z$*)*@J$yP3ObX$%T zzRS=t%7(g3t{Q*^ zEyTxT$*5+N*(plL90Bl6`Nb^WdKn_Pvpb{prO$Iu<5}~-EnXK7fy@_2c89d+ZhJ|)%qTOcbj#K2|l1B!3n*4em>_| zs0+)H9*C!kU%yVP5l({XnQMeRu}L5Sj@SNhX<@4AzfhMZW{P&$t(3w4cF;s3a!PkRM$$6I_u>8qK3>fr(_ zv-Y*v{SjgTfq|+BcyYvbM!vF^@bCsN)N`rpJ$><_Gs5*qVfQ0@761Os;NFEBr2V@4l75H}1u*H-x1FzIyrv zX4-neRxZt~y^&-x>*hYlIJHqt-rL&^c9<9eB-5QN-kNin&S^e!8s9rIjX$~r#FHSZ zPPGHSJ7NH?>J1WXHMp6{3_m_JHFb(pJM-&G@!UzwMZ19kYDMv8^_@35=1Qp*GU^C$ znS!nuvPQ5{W^@`l=K{0vn9d5B4sd@GNsqwYt13N;s_n$M5sF(Y{Gu{$f)Pqq6>`4( zoK6ZojptUz?t{2OQ@f4d24!GwYi6y465k8gmK^#vxd{Il-lBt^R7pE@jfteJwgkQ(YBxT%22tXdci&(7P>~Iov zlAF+-uyinD*mU_C1!Z!%vFE`wQx$H0WX*IMeKiv()c!!|Br&A#iWksE5wy*|X}DYF zOkmbb)NtBhwAgAQQ)W7>BzBj)^ec8BETv8dt~1Wtd}pfRmKnoYyMymV`fvW*bjTy@ zNFqchp{S-_%)XBfUmWyYYl$xVgQtxEVn358@gKtpQuu~+-Kl-33E21oa-Fi&oBI&`1N%T=`T3uD7xjR z1Q5DaVd-rOkkqXdK@Yti1APh3TN{S1DknOaE4Vdk=o-MQ!`zf#3^vm0RTp!s>(8+I z(BKlybb>#^&dE#xTWKkB5>RG$`5m60nzI~B_{R+DtsN)(K1(tUpuVHL0)mIKnUfCR zGE=xGXN@3g`N9QSG|T0c&wxuu*Qg<*+`PlfSfJAKfkWnRsVJ$bx1$Z`o)r~6%k4&i z<9I5}9(ypb2w!#-r7*;K+DjakI~Af;0mNtDxBc4R3|&8W^=h6KIf?>|@$@)*tlfRZ zrCkhM8ZMxnVd%Q>wKHQ6h;cwwxcI6738osp@h30JoAC1Si}3tS%4m{iuKSkF9xsrA%;wLv z8A#j|uifcVGx>ptY|-u;nJ$&yw-19u5smA=3C-sC-n~XzIV= z*~{{V0<$*x$DP?_zs?b?-Dsw+U(_(rI4}YY;n`g??R&MWiSNSHJ{;g>QuE+91GpRE zd9DfqUKVfdeAUwO7il>!iH(N~Y+WTTbX3b$$01o$aei(SD8PN9Ig|tehF6`&rMrwH z6C(}UhO7r4V(nXd&uyraV5X$iUUKSF7E#U?bu;$RHwXn03D2wdZR{}kbxlVH%&8F=8tR+X zZ7kKlMpt29EK0Mnb~Bm{1y*D227__FT~$T7>%Bs>RxQrlgI55^$os$sc`ic?+hwHQ zy%C%qRZZ?xjTT>R%HJvzYPmTbNJa&lc4N}*?d^eJ+TgWWrby|-X?$RL63$ocD0=1z zq>bD(K@l*w5V0aAqv-^DtQq(*B!;KK;S)?XERW0Z8_eB7>{FG!W0Tmu$$a@l#~e@t zb7eAjZ0Z_IN~+HjldvP|xLYiL+|mn)Q;HmqDMG^&^)mW(%Xyb~AG4Jkd@~F091U{i zRg(Zi(!S357h;^+d50bWLHO{(l58O+_d192vyD-Oh|kx|qkk|71w!Jdg*R ze=X`e#>jQ1n83%L37gJmxi{uYC;jRU__qGnk430EXC8CcRU^h&pyhVlHM8x(ce}=L+^|Pv zi|35MNQw6wsl4bw0P{NiUo&-{is+V{iXV*G{_L^ONZ@`H!#JZ@}t;bpd`Z>sx8;y zHg4#YSJ*anpi2Do=jWPejhaoGWKx!&jJeOVaku|#u8?8fCKc>EQ4j zn#0h@X_`cW22kHot+mSQz%;tAI|=i92)Mglsf!Nu*>=_g&(G0d>km#k&)3TllY#^u z02UV-NFuEUi@}-x=ETTTKA`X~EX5jv8~B<}HTK+*9&OvU2dkm`_BX*1VwV7Ij{pg= zxZNaUqPlcVYHAyHFof?m;I-ZD4bN%(@@2Td(VgI3 z{*lWmv$RZ|smov=_kGDznn+>_uX{A6;y}7pk@d`(Lh6{gFvrA5pAdMmu#G*QM1tQg z2^Fb6c;#}e`;nd&oQKh@*-zW!9ICOL;OFgA2-lpdOKmA=Bp;B_eB?c_df>veT)HW_ zs^sQQf+2B6j;5$>ZG`htEUcU*ioNkd+t(slRq00x_hk@N@P79aTAmlqe^(+dfnlOAm^WQavYofR?D70kyE!Q*mr z=MN`!PH<&(t6*5^bfSkgq80c+f6zkhX=!PVf1h^9o$GPX_wJAXim3%oV$)U9uWEOS zFZ=#iF~Q2FVvon!cVc(IvVedI_~ko1I5_AWe$&m4Pfz2dCm|J!YrHng`j<_W)9N6m zB@dJSV}^c#gL?<*=59v;JS=y@jX-JNZOq4)l)5={d`D-W!H@43<=pJ8Cgd+PhIgZ0 z&1}v2D7JC5c5m#$OqX|BP;TfUn_N`fm(NOG0@Nct5f0=5t?)gK>f*TZCP8 zE~vAz*f8;aNltIEzGmjk2?*gK)Xp4zr=6}59u!nRQiIH`r`BWA&&b%MJ+5|@JL))( z@lrFw!p1WBNbZB0IBSb692ygY3^VVnsCLI=p1DJ|9{R_viTo;ObrMJc9HN|9uopn6 zRxJ;a=NLyqW+8?@vXq*8_pkle?wWh-VSoPI3KIY*(nFq-Do;;Op#DRi6cuGIH zS7vFz0{w!T_jHtX9_!if-#4x3C9rYkU+2(KU|U3m|Bg{GCEc)G`)=}$uCcQ=o5}DE z4Qf|tZ$U3T&S;B0h&i3`PkyvL2&sK4L#)80)82naNsAnG!T4hTE7tIKfou;^sdejO z2^s6dG*bi~@XEf#g^+->YY)^i=j)rM{NpB6Os``bQrQDn`1IcCuH_tZo5u_RDCH9} z{A(qdv9-0;w%911g+6sdttId7K8LSzQx$iqDz9QJ%qEV5yOmP%C1^8VJ~&}mU03FL z5oO`+?_NbVx$89Jw_-65lS!LLL^<~>akOrQ*k8YT2f4npv!ne5LrBe1G zio4QV3V(pOPhsqCE2}mF#DXWKYCS~L->zo*5E`io01;dT5!%$~no!XU5w!2{HcD?P z$hkcJN$uNC-y%aa0(KSOy?hfCDA$n{jchN?d(tgsICQ1t%qbWQv5cv{T zBj3*W2{Wy5d$(v$@2djHMZWKG0-|MBp}dhVgo z`Vtvp{;P+IYGFXmo{Vm!Z+%cSOfN(pk`H&G(lF_arZgk!S9%x!bxKv`i?_8}mLXr- zfr-&54|LC~#MV?wRQm-EFSRGh4UA`d#pe!1bE-N?4{$Ro_JUO#b#A&ZN*AR84Q}u< zvAY2P2=^9%#QQFnV=U#iNT(o73@pmXuFN9 zR?J5~@ZQvv3RK1HlYa(JZ^_%8l~?wwv#lhDjuMeJDC(xS8@gFpX*CRJe8FTVfJFLE z`L1aE-QBK9wh8Lf=pv(3olJVvrY$Ug*U6Z?{29OF(VGVhgGPXNls7&Qa&U0KV+QnI zZN%rly6U%&wr&4qxD-ujjGO;@!kTH7t&RXS%qN%jTu85~jgj|mC`qh(pxU=LV<8nb z2*g-&X|S0`7pDK6F8O&>ow7=M28`!FRi!}mwg<&m&wRfJeJ}DJr|iWg3+r~FUb+VH z+^&Un8v5io|7I+;!f+OL&4~5g{fgrz&*uKPkBlbI#PEevl|9*Y;=ZITUOO{Xx3C?Q zjzzGgf??gQ$0$6k$=bjrn_FR?Ye1m&Alpp zIR2qAum=_rBrlX|_n?Z@`qf(Z0Kxll;~uBw&`7z9Rouxf&+){$ zT5l^SU3Q)C3!P4v<8`92?@GD3FQ>)aS@lWl&S_BItaudFE*~l)`|-f4TB#FImiY-_6&9CJ9!>+TEFxeaHO)c zvYblCdx~?kBnWI3y61_CZ7mPPn2!+y?I{+aqiJZV?FagXcV{P$qIQQ}eE8YeF~}-C z?~`EwR@Cieg6$PyJheqdg_twn9zXuoot>29+0UEtNnjKl>TgTSUIvF?r06FMW=5%U zVd7m{^kQJvRLT(~FbI!5QPR|t;QS06HwuN4s*dj5LYaTRDxc}ZbrgWm^`&@BlD%v{ z@k_@S)~9!76hB8Mu>D387Pt4nO+z=`W~vOK4w3_J5I>vM30q#&d2?0jd#W0;VqxAg z{*lOi191%V8^8z#kba|g@ zf4GgGK?gk~`S@>iRci6!kr&;RW(POG$iTAEX&_W3#)}zCBeQ12R}+C0SYWFB65117 zYx=X?gFD^+O{W+m*yAfTKmH~iyJk_ORwrFE`7|!~oOPP-{gCa4!U@A4tRgdFHX_Yj zXQ(+MhO_<^GRY)^`TEi#V?93xP#4UrcMTTD68zJ5m{DboqT=!RTMbx!3!QK?HvU2k za26tqP;3Z8*MmUwL{1I(@xTcd(1T(ot# zQ8@|QB&oA%VI6gn^=!_v)SeO)d`3{ewC>T3XM2ZqXV?iJKc$ft~<<46c!aV(J1mq1tLFMB0Q_){R1qliEw)EIh?S*NbRo*>YaPx z2D-q!@M}X!8+eqQe9(&`vcyr9*&Oc9DxIi1?hcoq6i$Ah{XCaH^2(3TA1)Kpu+!qk zA@V)hERaLu1FN%*CTT?U)U3}+-q2_=P0!NO%*+f=0%Wimi9$O7C`K!{L9kB*slT?q zUcI7*#C3?0;`R1E9%YCjZ^&A%sl;VB6)!NN8!ilSF2s{jaYk8%7*iwJVYB!}O?`NH z3i_o?`Ay@F!YSHq7T_a4Hx}qC1`Ys?_byXR)+^(UW^H6<{Jzm;NPkU97r0{^fT(G3 zA;><1llKwo;%)@{#|9*KE2Dmt;(B|5Xn)(d7V2nr5OXUnA1y_!SW`EtahHzmtl7EE z%djW%*H&HXZ5G=Zciw~l@@5<9~SRg`>1sdv54 zxFT-jCM&GG@`Q{Ed)0jXg#Q(;FzY%A{D;AwhdaxE884#bo;|{{h3OhPo0zbfk;Dak z&K2NDkc8^wVPB=SuB`+^8?cY^RCi~h^*4EmEc?J58r@|g3@t=ykaw*U{ z7v;3}@P2CDd|+0TV}fa|3wl21cs|OFu95chX_S0!)zbD}eUfC(!|&!sVnQ$17U~i3 z0k=jQ+>~NKF!oc>Kff(i>j!z@pZJbZ5Qp)A$c?DsJ8AAv!O6p8|34Q%YV*_nJIhup zmQ_{jUUf_x$nzc!4cNy^2`mY?*);JNgVn<>CsVJYluh4fgd_lF1||t597+ld|`Ww&*4Hb;}rzPmefkY`>P)eSO9!dk2T9lx>3Nj5=Mz z>r&3-+b)2!U(?WAgFX*rf@W9Zs)AS~lgtt0D77}&rQM~)i0CR!i>JVNn(;mN6vgZBRDJTdsnC?L>2H3nvZSp}#S z6*9#|of{57Sm7ktIRid*9b3ZPg&%fX92~R}5M69&e`W5`q8wIvKfBufD8f~ti%ujG zOKrw=EiJwBQ@H^*Kw5USk7cR`7;^B0t+_@D3FT&XdE}c8tK%QmNSn;A8RAsMn%(|0 z_}jjAHPj3;YFouX*X_FojE7Cjxz=b5i*s)&Yd&bUzA+NKT|Zgbdbmf54f|QjdK38q zi<5!1eI+@#xyQUC|DfNCc{vl9E=gF^==yjQil0#7c-)K`hM1O%+v4rCu<4wKEeA0> zEp7n)lZbgQlME&N{V?)eCoEp(d6K!Ss;kAyp#QBJcej|g)B$R7KOOkifc9VnF zpKF%Ab3TXaX3pJr!NN3W-J#nLcKyGkvKH+HgbCYH}OT?)qCnEf9AXZkAVH3MBfRj~6fiIx9-31EklLu#&A>uM1w2k;x{p z6SI?Q5Rg<8S^)#s7ktzJn2#%93?7_*{LTCC-tM45qH{l**RpP#OJ?_o|&r9_@2w=JQ0!~pTA3FNiUVF zjRt1OxG5gVaVzD&sIKBRWsLqX)%Dkp^<7D*ZZlOm3zvdK^caRuw0>+%#d)V}r&k&S9MyDr!%#@BU!SxwyIS8y<#pz4TMM)V&d^NaNs%w$r@xK#Z3m-2Z*B z!#C;VD$dR|<3`KMGMYA6xX-+QD(`rW%C9UZWiLh9%$D1dG#BLbF0BPZF6E_5rP3E_PtxKxwhc&v~_AC^KGDil_tZ4XGnVb_$U_s<> zm8kOFv>8SO#Z#<$=3;#hN0AoE1Eo}p(7cFS7Qu%^IP-@56DRm6;s!W0R~nyzVbeB3 zPAN{zeWb;hUGr&tp1Tb%L(Z#nGF@88afdvP=TZ9_k=he-T;vK+PJ?P6ZmqD(qF2)s za2N9|Lc_5Nh35`gW$V?KI?Em}*YAvfg$3DWNG(QvSZl?m(ctUi;Jj>c8s=iGQ_8IM5DCuHH6)h}yp2H=v=D>3DC$o5 zULiAntcT_b0+|=uYSp|RU-2AMnA6H6X~WBacfvSg6(!cva9ZpD*PX&B$NOGVW7m4Z zwa-Ri?VbD4_e>?M_?{Gp5;i_LZoeQ02^su&$#yDX?_v;bcFNw!ZP<6Xv&q9brr24? z|MPgFAc|V;-ru*smLhtJwEd+tn+gNbYoIlb_Kua^3mizF_sOpaD<1}%2z%fRbie!kaalVI{ zp@PyqhIH`4Lsqp;dXPhYq~D8f_H6FmSVw-c0o;ya;C8Y>viOHkmc!hn^U?c42ZCH^ zPvXs&ZghbhD2ne4J#b17FiS1I9RZ}k{S#@9{3>3owZjjy1{zN14ROf_w3vGo{JOw_ z5LgnbR;Hy3#ZJxN6{=$yTGHlT+Ef*p(!2*(M=pwq@gO`fH0Dr=&t+`4T`zSS&3H_CR^wcr&oGobo(9^R&aR88N zpw8q{)!yFVT7gxPn;IJlWjTZ@;6^gu0o~Co*Y0Z@emdc=ZP)|VUtU{c#1q@-m_(_F zc1`xg?iSXAbKiaJX8bOLsLi6+@?>^2T?51nOC5Th3E$~E6NxFrub(x#dXlO?;HtC3wTw{sEq|t|$syXv8Tfi8aLLm->hWZycx7?T zJAi@9^p4)TX$*q+{W7YJe2KLA=_$$-H9nhPJihFrO_S8hL+vnyy}LF)%0Bq3`+#x! z9*bF7ccIkdCZ@bjMt&SE&fg93dDU%csbne!aFMjR)C1<>dSOfAuTm{~rfOo&wrBMJ zi&P9Lc>oaIV)w+sO?^X8sjG-$-RvZfqbMm$3ez1Ue{7OHR`>b6Zq=_PrYSjFxJ0op{4-*e>HCa+ltbeRL&8rk zOpJhZ9$>74+^4>aDY$y1{+F~p?}C)d=kkO*yn}m+Ajw3dOKVp@e;LX1bbqRk?i+lw z|D*uJfF@Z)tVkhWM8?V&E# zyTmdhV1UEb^kae@-je}deN9LG-8T#3h1#ojCe(gby>*zW``~(Lb6U7b%MwpdqEq(K zEAS{$i7H)RbG~^`>SjFQj+Y?^Ft_1`?au+^$%R3VO1zaZ&?NS4Ry^!zZ^1c#NF#h@ z0TD8T#jmQSaL?JG8@5uub}qy}n+?f&XZkDn47o*x8=R+CS@9|@+5Sc{deuI{#-k@8 zGwVmk8dyt-NdoEExb}uMJCH}0UCrJi0uMR>5}ISY3=oBH&_hoY1^&b)i~yE}u?si% z-PVt&T)q;ZjLX0sQ_TA3bY0+hmGSl}+yLQsMKtH(tvC4_;^TC@vXLuNNTcgL$DnOmGiLhtBsMO^AN`&cRypL?h%J zBiGYxSf4}dsU(n)My$~2GQ(fLVZL#U{ho7-j1j?+)IK2=G zzXCkvL!y~{frb8dl#NEpiJ)7iad@m8(PH3p4?x|-%d5zWr95 z{rZdqX#)sbTEuODXWBnoDA=^8YbJDSV-L>lfASXZ8D5y&t!Z16)p2XHLUQ||$XzhY z(ZNTOhU=WEWxG?AOmpj8K~s1|a(9*t@!RB$%7U*=_M=t5`sWAFyuz~O>Pcjl@Xup- zgO1W}S3KEY&FGc`(1n6n{`G2ikZF>bki9HXRA3j<&l!tlbJ90F>rt$!$g75+5bn&= zjyM80QWmZjI!*;6oH#S|oUcV47FQsDUj%8+H$#7kjT51X^Jtx)%R6|}%#Dzl{ml^0 zsv`Nn-|Bz+48SiLI79mr$g&j&34dbw@n{EdZCF)Q;Eel#;Nmcdr^kRV94rNTeQ>Vz znJP$)fOxR055Bx)K9o5)r}JEv*;cD>C^DQx@@g87^oPS)Thwn;1zXm|@zi=;a?}5h8y* z6>(bt{|;@&f#h3nUIC~HE_8P)0gPfgF)Iz@RlCu`TI%(q~$n4sNz_?{|9BnSz}B&7{#_ zK1qBPIgO|{V&NqKX{rq+Kghb{e3jx$f^oK<{_owdP6x{tVp%vtu+-oKp~{XTyKKwM zX$Z`c@2!q%PLTgNKUeKOH3e?Z#(AjRAjfx2O^o-wLC-f~kXBCsjG2SB4k!3w&_%ssqiht1fi`gwthS zZRJxsc=Hc02T0kCbeye6=v`L}H=CcUFBS95I`opHXTIPR!vcLUKAVpo{skf;5|%cj zKZYwozQ@0;jmm7Ewzi zo<*oL>r^0lz>yz>?Cy#9!RQ(wwu(u2d3jTu6aCREon8S6b$ev_gGij5MEh0OwVHeY z3JMHR>*HK->0zGG9~TkshQO@B>eP?{hJE$f;3N>uRLhJ}P~ZraSC!2Z-m?eb14#V` z%Wf}!yyU^lkZyZXi204#!G+O?Q@ceB{!4N<(Xh3BuOxshEnNU26-F#`#RIs>N}(pBW@Si2rp;jR0tbkkeB?zr zS^vJtRoNXb>y}tW?zt}O@HIPqMztv8X1Mb1o1(k)Qcp6Pr6uU+Wr|!Hv7+$?#M_2O z8ozNt-UfLk4P2gUH6A!~G!t9m9h^|<)O4k5$cNw60eE=UoqqjQ71i%yE>IF5MMw53 zoVZpnlyb}7VoR-eL}JL|uKeGZGj%Bhl-tR>S%pT0QE3%}REJ4vlQXBz;^otxhg?Ch z8XD=ERaU!$Uo=nzVP$E_ymK_%iP6+MG{s;{Y7rF$-fQvmr}-!7R+5kFfp=OE?phks zAIRMnzl_f-n|fdFUx?=;*-?y8#j=PGKPpOOOfX}Ic6w;#a)+T)JYU|+Xv2w$zY|)U zEeeU^HM+hO--oSU>4i-+iF%MO_+IX?wo`R@!WLpS_grU1%73579~%ph(hCzw#gqKS z33(@oiGv3~@~gXqf5#i|_#YMm|B*Feu_oGLserI4H_P&w_AZb(3Isb~x3Ld2CgpT^#omehU$@8! zZ37~|Sa6Xc;y@q!+6z@#hh!4ucXrj8>Qxso@J<)u1I)@I5I^A46Xis^4@P!i0{?O+ zk)CZ~poU|sFD2L)#iE|&ssJ3xPipy!K=bolV9l|2Z(i}*43Z1Wl>m~3P4rKR z;{jYf=VLJmi^x2<{AMKuKw`P)#B;8nQBOIhHy->XNo^z$xthq*cY@X>W!5<4<@4FX zNAk9jj2q$VscrAdjGHmRtbN?guU-Ze<)BHW%*jo5k{5v?@U7yU_yhoD$uz_q-~545jZuxv;JUQ*eFqk?xfP@lh~jP(N?2I0NIZ-q zDGD#GS$Z5%#81&o5Ufv=)9xJ28~UMS`u^V4={bp#DxfwlU7@e?)*KGps|+y(T@tnr z9A#fLvb5wqpXG&eyWHhX@kN1}iO>(98#j(F*qUrT%3$LWY&VnO9gyxolrhty?u8%M zar#N)92>LMOfsB>_D%XweB1a5z8o_t7nV53zGhsGH=Ml{GE->_3^aZ?i1k+KH{Bi* zY{{urjeCUUx{4awMMqbyudOM4lcFe}f0kQxel&TCX;q8#ItaBSss?l>cfYcppL667 zS>TiWKH{ZWLw~L%seSo-t#ZVhl2DGsZb6V3qms|C<$Uq?0!WD znTe>ujm8kZr!xr(ULadh!(KEI*eP2e8ztmktEMSwD&hN43ddd7xbRW-tc40~ z19$nWlggKs>s;Od2Iq;+HaSzqE~nHmhvFSvxIn|naZo8v~4WofUl z>!4oJlcv$-(Hu&G#ZJ_w5Z)n~Rwk6YVkfc4?7^k&H4vyEOMEwEPa;GC(@sG9UK0l< zym3g}=fXdvShWk}JWOfm_hXjhW6NC8L44=y9MCIOFwlD^9541durm zIjxI`e%J5;RSEZ-PK64!Z$8JYxg)OYus$7X)=3YXtpuw8`FEZoHX-T27L3^3mCkP{ z&5K05BG=29L~TDoxs)Ze8YnCtB6r6s5%IM>J{E>lKnexjk zF8wpQnq>*y(C;*VyBSQLL0w@L?tQ?-PuO>uDOcCX?6xMc;$ZyH<_&W`uj1gXTP$N^ zG4Xa31VfrYj;M^;f(-Tw`<_7wa3DmU;dQiQf z7NxutM)uz=k#Ko!M0*iv^qY@@ibmclp2|7Ykd5wdL5{;9N3m~n4g=tUwe;P zI25w!A{9r;$eMW>q{hpo19Bk1pe=P>6r$o%=>7_cjN&Tm5M|IJuUvH+AK${CJX4oU zgO6^=eBKAuGz|tm+nSrK8|c$@b06AJVIe41Kb6p*)`8SjV>XRLlD=n zxmF_SZPNO?HOkAGmreqZP`zhDat0zvL6TUJs#jj+mv!eE2D(4H^wQ8v?J{{F_uNf{ z3Guwlmr_Y+?1xwv+DlCV!Qxf3`85lI9<3MYLPv#eKnDUu^wHQ zc>gm5549XSAWHZ;ccVn65dF5Y_!SFO%Z|}Q(6SZUI=Dtc;z5Ty%nrLYb#L*-Yh(x- zSIj@A+IWZB(0~zQg=&PNK%${P5hZ>29oZHuVGWHXY$x1YFsQbXHgN={wk@*qqJ+Nq zd)egXY~a_ZOiJe;TU+HKlsyJTMfblt8%od5*(H)*Q$D;z+^%AQ4mXPuX2k}%-4;79 zmQ1FAba2Ra`Bcxdj1l&?kFD%K^S3JRgKXK4^qjwecz_P2uJ-l zC)Qvqm+~M!v43_gwKDlR1nJf$++0o6yE@XCdZL3q)UgB#ypJ#vJ8S*1wxK1+=6B}+ zXR*cqf>giPZZtBQvI{Zak5z&s<%W6@C}Kc7|Jd$GBC>hYST1Qs6_hTGb>DuR924B0 zN83(4+CxS$>H&|*-r;Fo4NfL83)iN!YZ&TeJH98$Hv6Ebv4bJ|{_ja0c;iH3BS>3^ zpqgshmx8R31o2gdvH`OqjyW=UU6imxAx*C0^Zy99KL{oAvkpUJI(*CnkaZUKS|miv7yJG9ATWhm{X zmhwPou-YzMm|1!Q!U)jjx%z~gla=8UD)w?G&Zaq~DL{YDwlSN`Dnf>gnqOEH6`e=5 zK`qGvB4v}6phVXVBt;`Goq9`6$1(ekF#8@rQR!O?lVvgou3PA{Mrgg$a_qp=fEaM+ zd)RS3^IyJ;lNL~f*%#*d`QhDdtk^TrNIS|sGACrecpC80;-?Fs23-ZoFWU}~?O7@t zRJMKubhf|4AK65+^Yw8fyef3O1aA8v$s3mu7PHe^U+V4qu@K`r&lUl#^MSr$PX__o zkc4H6xZrmj{B9ymd8uZ1l@104i9rzScjn&(C@ri42@jd|ET?03nMCrOz62_&EiK<& zSBCb#CxX4Kax$9yU;Qik2A;XS4l0o}3esA}H7YGS`LFZ+Cp-+Ao3iV`;Y2#t+RBw4 zx0Nc0Q9y%mXU8X3P%JXaJSA=%)~{Chg+d_{`+@cih8jx$RRzetz1P5XI7rt8+K9*g zkSIZ8rn1WK#9AdD3qWOXE$*F3Ot={(vVp^%iu~vZN~NYgy8_O?l!!1aW}T^|BNP&6 z0?qjrcZN zmjmPbA_FH7lrCAL1d^70)DpX)@;aCfO87MXaxB1q=%jAw{{D`eJ!d-BNT7BMlMWP}{ZZ&o`DY!}ep;HhTV*iZR2Rod;vAPt=MM&iugW*ReqJUt5Qt_q8>ioMMBX>R9!hDFUD-8$eYs z1-TtSGqXUHgLC2i8u*t{Y|w|+jMebIyJ4s^A?cD}pz_yAd)%*nkt{$;7Zl-taBgGY z3@mR5iYU7aF`|s8$6+Otgv24;=D;){kh=%;5zgNp{HcTraHisq6ZRfb zGW_De>QlN^)>%P;wg-4IfgjGe)9@8oA5f2u;i&iuD70ZYZG>GVyG?KsVh7^@q^+_&<9k|1f{n8Ys}&4 zar=)5U>;^OAAH~;qzbCyEiJ*~gbv|vsZP*7fI2Zi@i+OI%Qu*&(tT@erO6Mb(Z$59 zguP#oe4eqid_2;#q}qW|`vO7O$`jJe$IvZwKK6c?Xzh#3XO?(!b^2k4;!# zYGW=JqVe>I?z~`PT4Q2xwFFNu6ey9UCv31nPenw9f8bRc#Vg5bJF+YgK;aIo$ualP wqI_@;Bx5sQADwv9=?)5}0VhV#cC~Kt`tEf9DgFWeNC#x3htMsB-+J`_0Fi|iga7~l diff --git a/docs/reference/images/admons/home.gif b/docs/reference/images/admons/home.gif deleted file mode 100644 index 6784f5bb01e0104c60e006a2ed525163a380135c..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 321 zcmV-H0lxl6Nk%v~VJHA70KxzO;Nak3U|_JYumAu6&;S7N@bCZt@Bjb+EC2ui04M+` z000C22)f+N_DFSAmXsV{#*oJWIwOJ|OFii&dHVi$1?u8o=2teG> zb~7H4%2JKz`Tcy)XEL^=cAP+G_P7moKVb2g%$4rYhp9PeRzLz zfrD6ufORfRiHeIHgKCh5l6Fj1nwy-RR)UybJ_V$url+TLhynwsuCA(~Rj;(Av5lgv zwwtvDw^OsE0|vwftp&x&!i>OQw#ml^r_#R6Z_dKdq|~Li{txWV+q;;-NCjLKH8RzODs`x)zXFqfx?o2&^85@jF7AWJN0jDQd6 TqQ?;{LW&$ovZP522><{)rIw!r diff --git a/docs/reference/images/admons/home.png b/docs/reference/images/admons/home.png deleted file mode 100644 index cbb711de712dcf06597a3a8a3d95f6fefda1f245..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1156 zcmeAS@N?(olHy`uVBq!ia0vp^%0SG|!3-oLGuzY{7?>FXd_r6WdIS`E6g8)48qP6v zn&afP)GK*ya`E2cmc1=K$9krmo3ixW(yjNl9=mt!-1BqS-d}tE{`vdw@Bfd2(GVCG zA@J$l5_e#hU`+CMcVXyYmGuB}CVRR#hE&{I8+eiLumVSprtq8v761QlTpYPgC-&05 zDJ{&8o?4V1EYqU7+)vOI#yLg7ec#$`gxH85}f}H9d0^ z(^GvD(=(H^6-@Mu^ehxCE%gm7^bHIZl8Z8nODY|5D~n4qll4-I^-@X;^7BgclJj#X z?o!+VG)@a_TxNP+Vo52`JVR3xV`HP#G)t4DL{lRpBV!ZeBojj;vlKG}W79NC!#D3= nHUM?;fpi4`tz|GatuQpzHqbT@s&o4Ulwt66^>bP0l+XkK0lack diff --git a/docs/reference/images/admons/important.gif b/docs/reference/images/admons/important.gif deleted file mode 100644 index 6795d9a819874ca8b833c4d4993988721489070f..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1003 zcmd5)v2xQu5Iutd0|w+k5&Zs3?l2X}aDS zjTF}vbzOHH$Mba8b;e`IbzRT%eBTcOF$gq_YY0gQX<;}D0zVAhF!bZtiem@kQ53ld zc?kJw3X()jQz=b5X{r%YqZCjoWEse^T9yffD1>wGXnD2O6PLX4*vhfx$E#2ysKF~)d4pDz}RBuUaVC4^8)m&+y7^CACN zNWZET0BmraH<<4P+`FFGYnVCKQ9;ZBR3T)qVf|%U7d>simE()pGuDQwHb2TG+MBQ_ zvDDA4Qf1%Pj=rj3vOLN4H;wu(_qSJ$@rtK60JzIpt9fbL=6P}WBLJ%VyrBKnwv9gL z@+koKj|(oEHhf+1r)*HA;C;h{WiuO<>j@AFLq1UdID5A%&u-GCYUTM&`rF#A&P{r^ z_xRIVhqhjHEgv=NdwEBz@%x57)QYSpY=k4uyJx0tows>V2jGshqK7Z@I~q3m5W5c^ zZt#o~c$MEO+~MK7@*>Lh!0mEumT-7-ns3eG+lQO)ySz&7zEB7GF&sm<)jwePAZ~s8 Q_s=i~Dg!i1^#?fn4NukiE&u=k diff --git a/docs/reference/images/admons/important.png b/docs/reference/images/admons/important.png deleted file mode 100644 index 12c90f607a1b27ddde0a7d922ae255e8c90e883e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 722 zcmV;@0xkWCP)Gdz_qOoSb{LwMwNgp7=gl$4aErG%}mjHRWNrKOy`y@b8JoTa6ut*xc4t*y1SwY|N)#>U3Z&d%1> z*52OU=jZ3|@9+2b_y7O@tTMkk%M`~Kg@u8&dg_P^_0l3yQb639!jLZt^Lx<-O17UeeJ z-|=!77W(jGx&e#?FOku-gKofoU0$~4M+dhLFueEauP`}l7LV=;lsOdn%WHure=x;k`m0(bF&MU#) z-qv#^n8(MjB|ykioqII#+`g4no-MU=BK|Sahu_3M_-d*=7hq=~t?^}A)G7 zbairN0An*{V`DL9V>K}|HDobmIW;*pIW=W9HaTQ6F*7kTGI9=S@Bjb+07*qoM6N<$ Ef=i}M4FCWD diff --git a/docs/reference/images/admons/important.tif b/docs/reference/images/admons/important.tif deleted file mode 100644 index 184de63711510990ab0a8f483c274d2f11596cef..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 2020 zcmebD)M7AWXJBX$dk|ousK?9JTDdL8Uq@YU@bJG?*jxfpA<|j-!WmZOftnGps z2`M(7+NV;37GB736>XW?tSpqXE>}~nv-Ps%oEtMlIQW-6+n$q%9M;|CK z_#F#ZV$1tJGvEmalTiEz3u}o#Tuh>mHiUOeO7JnuKG`_As3Jnn>nKNe(yJ$T`WW1e~GYvWZ4Wap86IdPu0ZRZU zVEzvR=YI)c=}-+U1EPR<3b=fz29^QIz>)z}8Z2c{1j=VaONynyvH(;CHn0?60O~UY>I?#w0~|oMCXfdzd#ZtD0Rym90=efsxO4)k@&c9v z5Z5Y>mIBlY0dHWCG6FG-=41HBzycNl3Ie5=!E6Z-6N$|PWrOMuW+jIb=LGEI8QAA*>a1B0!;`T|n7uj>pG`jtu{evhJMNxcGSe4+aUA4;zBR~SJyxQRUcWR@_F-^jeWYB);NUiculZ3jmx6N0 zeB+OSXDhy@IoCx0FO{tph>zHm!T!klb*W-Q^N$-zxf}}=>~`{%GD&ps=U<*F$^Pgw z_kzS@O+PsF&r}G^Pim1AepDS}@Ytzl3Ts+UM}N_=nLk9*dAj;P>|etE;is#v!2PUi yKjIc2Q@7UKxAw<}hlktwFXd_r6qS{MX+1QdG|HK%AA z&M|bFA9tAudUsBZ|kvp$Id-JckTVP=kK4t z|Nj2}C>RZap&SB+ixVCKvjk(3x4R2N2dk_Hkkjkw;uunKYwyH|T!$5ST0$SiY~H5U zR{cLbR)lT!-5c|b6rGCX%N?2P<`-xxUu`gZx87&*3!~4wH@%p0)WuYX}UBIC~8cAiK_+plk!-xP|nq~%Rem@g?39waS$dFIAw`2be&`&H`~ zup7N@y!g@N+18CSR#dLnIlgB9pXN>WRz-=n38I0oRnmeW@(a^WRPZVkYb)}kZ6%y pT0bWnsEZGzD*$LMgRyCap{cfkwt-Nc+b5t5gQu&X%Q~loCIEjWXuALa diff --git a/docs/reference/images/admons/note.gif b/docs/reference/images/admons/note.gif deleted file mode 100644 index f329d359e55c7ed753170a6f04fbc0cba1e1e565..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 580 zcmZ?wbhEHblwgox_`=Ho1YTZVK|w)LQBlds$=TW2#l^+d)zvL6Ej>LwQ>IK=x^(H* zty}l*-FxiVv2*9nUAuPe-o1OzpFe;9{{8>||AFElBX9%7pDc_F45AD=ASEC>8Cd@% zghGJlBo$966GSzJUe!6ZN$1q35SXB^-zJAkEPj)pXq*a$h_ zXQ+sXsjhEmXhNv37hJ?OaLOg1X|~+1jSyWR(o`3y(c1;Ai!}%$em*Glyc1BwlJ~NK zuZpLThNs9@k1ImH0$Wth2s`>W>73rA(RIXT!4{9MLpCC+wq2hkd_`O*d~)g9;?U*N zC}OI4M1Z6Hl7Y`-pGiWx6O;l)uFCkcxOF@EUU3NwS>oY6#RI6O?U2byr$d1v9)TjN znwNw$j~n?OWwbpf2zH99Zo*Lqk)s;^7gg9U27sNV>(8nyV%m64QG)9cM8x-WNa$(j zzz`MJAQq_8eSmmjy7}|Lu@zf kf(CKug-JSrEM6BktMtGlBGk2ik;bV{KB5sIO^OWG0Fd3m^#A|> diff --git a/docs/reference/images/admons/note.png b/docs/reference/images/admons/note.png deleted file mode 100644 index d0c3c645ab9af6318035b026dd86944b9ddc9114..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 490 zcmeAS@N?(olHy`uVBq!ia0vp^5+KY0Bp8m$B&h%?rX+877Y2q^y~;)m42&$EE{-7; zw^Ao5PC9JB<666~wbh%Oo7tJ0_rGWfi({a(qjR96>_P4H$tJl=Pxd^1p6`8M?=jE( z!hchf6<8Mi`NHe6`iia69>!lxe4C2-S>+Wvj;l63k!MNSb9|1+f-i>irDi|a^uLl% z^#-f2#pQ2lC%m~9m9JWJZL3|T8FRX>A78<>cU{Z6XGFG336=OLGkw25|29|RG_k%U z>j|M}Ih2i#-w+9_WSj8)*j_s0*s+gA3;Sh&ja)bx!VF_Sf>*se@&+kCgO zr+R@?&ik*cqgb|1nDsf`Smu_<(#~sYRz=fNIgWLC7l}#=|C@V!^7^u?J-&S9hp(U4 z$p4Zq##20*5QGIHvwJ-nxqBD;h diff --git a/docs/reference/images/admons/prev.gif b/docs/reference/images/admons/prev.gif deleted file mode 100644 index 64ca8f3c7c6856d17625615c7845d9adf8b35e6d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1118 zcmZ?wbh9u|RAW$Q_|5jIb=LGEI8QAA*>a1V#C72?E=btEDjqN9qpDd4zl5RF#mYJf^(P5PkwoZW(JQ{ zF_D*4y!wR%9~DOmG#sD7{_&y;#{p%(<{xE#Uw&*>uv^H)Skbd{qJrHLc7}?c9UtQz zYXTT6YHoZvu)pcYrmCD9p$~wJBmbf!%0P@OYB}B?fNF{YnIe9ySJ<~ln9<}1LcYr;@((b@HMtAlPLh^PsKR!G>+|CbXxWHL3#->LwIhe?U cW`4ULC`3qLrpm*X4$b9ricTFB5n!+e06MwKH~;_u diff --git a/docs/reference/images/admons/prev.png b/docs/reference/images/admons/prev.png deleted file mode 100644 index cf24654f8a9d6826bf5ee3f6b640d0b34f44d2ed..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1132 zcmeAS@N?(olHy`uVBq!ia0vp^%0SG|!3-oLGuzY{7?>FXd_r6qS{MX+1QdG|HK%AA z&M|bFA9tAudO|H@7THL=dQiK_Wb?x_ut?D z9|fZ!FvLS(&zmEwfLVeu$=lt9p@UV{1IVfNba4!+xV3fSLB2x#g-7SkiDHi<0%5c709k4@>c%U5PUn6XiNrQ7+$BX-K(BEj>;XDjvwZcIF~ zikDl%a$|T|&B@5M-I14sdv^1r*gkp|z3k=crb$1i`yH45`zBpRc(KYI-u^rPzjiy@ zGH(5%+Qq}Yvm59P=MvY5lHmNblJdl&R0anPWlhiA#Pn3(#PrPMYy}fNBRvZROG|wN z3w;Aah2)~l;*v^-+{)sT%w)aPV!f2og8aM^z2yAdiMtec0FBcE8<&}$msnB?G|wQ- z!aOlC%^=CZB-O|yDbdi(G|ec{Bq=S?EGaqB)I9sbjHy6fd>~x`Kx-L{O)CsdwGFfl UgzDTr0c99GUHx3vIVCg!0Q2->tpET3 diff --git a/docs/reference/images/admons/tip.gif b/docs/reference/images/admons/tip.gif deleted file mode 100644 index 823f2b417c797bcc5b5af0d86034bbbe68a9c5d8..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 598 zcmaKpzfZzI6vwMTVkAa>9EomJF@dB^cAyaw8YzNW>;V&-Ax?~pOgK0Qkwp3j7=?eJ zp(Bd}iDHPQ&cwK|BZjz$_padR<(hoox1W3W-n*l8G9sLBGh57bgCWc1aD#QQmI@nS1Ofyy{@WiyWQ4xz1!{fdcDD5FdB`<y3!k zEzMQ}>2XNH@2x$azJrio4y76u%{aaSQ8iI0-$_v{WV^70wC+frSXf@6n4D`V#?Bj* zZt`izA4lq-+})D%wiNUU4VVF+%2sLK@TMg8DV7ztp%Z(?@L;tQU1CsK&Qwqezj{Cq zSwCP?&P}GNbF_4EK-+twGeQq!I#zP|Y+{WP*FI?V_Kf=>vV0rySc_v6yVepU`O=gc N_rd2$!U|dD;1^e0&sYEe diff --git a/docs/reference/images/admons/tip.png b/docs/reference/images/admons/tip.png deleted file mode 100644 index 5c4aab3bb3543191c360387c4af9a3cbaa051345..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 449 zcmeAS@N?(olHy`uVBq!ia0vp^l0YoM0VEi-?r};1DW)WEcNYeRRlUkaK;CUn7srr_ zTcwkB3m#VBagbEhuIO1a$!w|j^feEHv@=+|woj32oF*6|l<3XH$!T}Lao)e6jJhoQ z_vr?OZVprC|7iZ8xaicUR0b&zR-JdP408=+?zC0Rn8IN&QLTWhMIcU0X8P7uUN4WB zR_?a_;&p>ll{>(OzfJ4N{OX={Q&zNgO}j31DC;|ya^r9Fjd348&p+!^cT+^sws+=& zCu*T*mRNK3PE;$BNx$Fa_9(Y=&DoXLMFRd#U31O)<`W^F&-o=xbIqK-c?mr!bmn>! zky6TW;ML~4nXw$T{yra=OteL6G!=B;0=?;6;u=vBoS#-wo>-L1;Gm(b>6x3Dp6Z*J zo|&AjV4`QFXQ5zesc&GRZ(yj9T$EW{Qt6OeSzMBtte0A>mr`1gpI4%noS!>!m*Ngk zP=bxiOwUU!DFvFBnrfM1VQy}0X_lO7WM-b2nq**TZkb|inr2~`WR#dJWc*7VsEZGz hD*$LMgOO>4k%_i}w!yxSoa=!y44$rjF6*2UngF(YpwIvS diff --git a/docs/reference/images/admons/tip.tif b/docs/reference/images/admons/tip.tif deleted file mode 100644 index 4a3d8c75fd58190ceae8d6ffa621ecf7e925c3c1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 420 zcmebD)M8*_WMF8pe-L1yJdc;H$tf{F-CELXO3;xcp67e?gucfex%0l_j;Y3!bk~Iw z*}inn73j9T)O}-3=fCGcYZHT(zR^l}-s<&G=c&#%w(qtbzQr9{)4X|tE-LgF&v4l4 z)p%aZSR=ZsmwRfU)`umDZ@!1L>ZTZTei3kDV32yV!Q3h+-nMlqyV>lRzWV|5XS|!R zJ9po!|JC=_hMz9Ex3Ove_O<7Ki^+ZG3OW)0HK&YExa~knT17|Dw`}IsahgrSch^-` zbR3#}CTEJE3FpcFHhEeT>m*%ClD6O_#XWHUqAtUxv!lnpXbkP%`INR23xxENF% fWR5tL{SwHQVq^u|^$Ez9hO&PF*|tb}fm{Xvme+K0 diff --git a/docs/reference/images/admons/toc-blank.png b/docs/reference/images/admons/toc-blank.png deleted file mode 100644 index 6ffad17a0c7a78deaae58716e8071cc40cb0b8e0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 318 zcmeAS@N?(olHy`uVBq!ia0vp^{6Ngf!VDzk7iOmbDT4r?5LY1G0LBeqssYGrXgF}- zKtn^rf1vn(hW}s+NCR0w;4iG^2^42c@^*J&=wOxg0CMC!T^vIyZYBTtzyH6zKuy9A zentg0F+qV0g#~P97#OBpaJrNsxA6f`rE`gEL`iUdT1k0gQ7VIjhO(w-Zen_>Z(@38 za<+nro{^q~f~BRtfrY+-p+a&|W^qZSLvCepNoKNMYO!8QX+eHoiC%Jk?!;Y+JAlS% zfsM;d&r2*R1)7&;o@#7ik&>8{Vv?F>U|?x(ZfKHZYGz`bmXczeoR*Z-Hs=yh7cWRx f0MJ?nL(>XNZ3Ars^Rf>h;}|?${an^LB{Ts5OHX0g diff --git a/docs/reference/images/admons/toc-minus.png b/docs/reference/images/admons/toc-minus.png deleted file mode 100644 index abbb020c8e2d6705ebc2f0fc17deed30f2977a46..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 259 zcmeAS@N?(olHy`uVBq!ia0vp^{6Ngf0VEhsJkjh1QcOwS?k)@rt9q4-G!sMP)HD-wQzH`-1CumMgJctv6pLi@6hos# qqtv?{|7HPo@q%;(0Ig*(G_A1IHqbUOFZ%#8j=|H_&t;ucLK6V~f=xvL diff --git a/docs/reference/images/admons/toc-plus.png b/docs/reference/images/admons/toc-plus.png deleted file mode 100644 index 941312ce0dab168e0efcc5b572e387259880e541..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 264 zcmeAS@N?(olHy`uVBq!ia0vp^{6Ngf0VEhsJkjh1QcOwS?k)@rt9q49T#T`K7w7|w?rspM=lmg95OfodLFfd9rOi4*hH8wIdOfpPPHA_l1 vPBO4aOiebg{jIb=LGEI8QAA*>a1V#C72?E=bjEDjqN9qpDd4szjmF#mYJf^(P5Pk#A^PL<$Q zI+;RG?K?R>ZZ+XJpnRtJN17PRgOAG`Ypgh#KAaFZVBhwmiI3&M#ti2gFIJ`xI|LdI z)N_AywPiSv9NPY48`Fms0t^T1xjuG&jrgXxZ|i>{CW9aPigr7S6dxV77JO*m^5e&) zo(}&F0j>Y}9vSZmQL;N0Bl*v`gWrf@#t#YRf*HM~)&2b!mjeThEhE5z G!5RR%al9%3 diff --git a/docs/reference/images/admons/up.png b/docs/reference/images/admons/up.png deleted file mode 100644 index 07634de26b325b09b6686543e3743ec58426e64b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1111 zcmeAS@N?(olHy`uVBq!ia0vp^%0SG|!3-oLGuzY{7?>FXd_r6qS{MX+1QdG|HK%AA z&M|bF#=*s&OJYO?ftdq@1MW_{{H_c7!85p5(1lc z&#VJx3C1LEcNc~ZR#^`qC(YBvF{I+w)Ct~v2NXD1b6>NwI=-vFd2Ozz_LBUAZ6_V# z0_-2ED|^IRKipvRGe~yg+2{$+0#aW-GMHneR${}Twfy{=Zu8*Wewig#Kj<-8yG4i7iAWgR668V7MElu>!lX!rIZ%r=auLs=jTq` zrMLrVoEF%)%=Em(l2V{~M&{;5#umm#78a?N$;qjPhKZ(zMyW=L7Ktfo#^y-|**sf- lni%*%x&naKG8mgy7@BGuXd4LCxqSjjdAjiitKf)ghIjv$xRfA5@!fkDH{bMrpZER!`M%%z$hqF& zRTo^?=>a_=-~^4}0c5}joCOph4kUmZz-=G{VS5-sP2q6X`MO`-x!!*rW ztyZts8;wS@*(?@mpZ^}uZ$}#tfY(x3o*?Xoo>h`d8|jmC(W5ivVgErE1sEKfo%%8K zZm_%KW2+i;iCOE!&3{olD%O0Ac=Thp(EZgCUC z>m{!ZyCyqrXB4)SL^$CI^0ECR$tT=P*F@;1lfy%=Q(o%DDkk-3k1-hj`YC2`iO!;PB{{!F!o39xr+d_Vw5fMTEwpb-s#9q<5Nzz6gIepyU?Lctpr{ZK zVzWaWPAC)#17S8h%;AIuf(Q_yeIybEqS0s^i1YdJcsv0ln9M{Xkpz;-I_^=P))~D~!!Hvpq{Dl8O{rN@cECkt>#DncX%I(O&3i_YgL-$m$VU zT3cLBLS%M1`o{TBX}S|Tbhc)vk!Yp)%rdDd&my(RPsxl%lU$)tC?(1~WuEwClUQn! n$Q8O{Mxt@ukkcT{K0> diff --git a/docs/reference/images/admons/warning.tif b/docs/reference/images/admons/warning.tif deleted file mode 100644 index 7b6611ec7a1980022c11ad6877fedf32f41b3df0..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 1990 zcmebD)MAieXJBaHR|qhCa3Ybt#fe?OBZVhOke}_5p}~zDOYXJdOmf$P_Zjir-v(f(n1LVCeE22NskqJ)$I5g z8XP9S{LzviJ+sf*L4iXe*;u-Tjq%lq8EgzJ!Hcg+?M+EyWoUYBc3S038aqStx-zY! zDFTdKac@c|p3q>CIvAgpWRM#aTC%3+U_*~obs9PKLA zwdWf7S{m)1m+z3c?Wmx@z`-EEAipvhp!;Kbm?5X2D0kj+rcP|eW7(8DkV2Fki5IhEj=NKUH8UqO41H$KE_?`g-zXRd_Q8-9KfPnz02B(N>pejpX z>SzI`howNaA&_POrkNgK+E@xq2Mpl!zyMB5$ACOgn$iTTxCSKe0kI-51uy_p+j}7S z9f(I$z~Bf0U{v4*qwzmD;)zDC@CHUcBM`%AK8Ak`EMO6Es$gUWvn4>Pkl0L6HV06g z8Omk_ve}?)W*}RT5n>KVjVM$cWRn>L~%oSd9oTwL7T+&nxy zyu7@8e0==;`~m_3f`WoVLPEmA!XhFfqN1W=Vq)Ur;t~=Pl9G~AQc}{=(lRnKva+&r za&q$W@(KzHii(O#N=nMg$|@=KYmvnwpwgT3XuL+B!Nqy1Kf0dV2c$ z`UVCDhK7blMn=ZQ#wI2vrlzK5W@hH*<`xzfmX?-QR#w*5);2aawzjr*c6Rpm_6`mX zj*gB_PEO9w&Mq!4uCA_bZf@@G?j9ZO-;?s%`Gi0t*xzX zZEfxC?HwH*ot>RsU0vPX-90@$y}iACeSQ7?{Szikm^g9bq)C$|Po6ww%9N>7r%szT zZTj@-GiJ<~IdkT$S+i!(o;_#IoVj!7&YL%H{`~n17A#n}aN(jwixw|lykyCerAwDC zTefWZ^5rX5tXR2n<*HSyRoH%*%du|NsArKUo+Uftf%D zloLRCf`MZx!~eg#-8I=+I4mvh{{H^{{!R%71_cjB28W*F|L=~16e_0!iH^d4K?Vk| zb9al`Kw>>fAksk-B*h@W3^J6Vpa?9*ApqhqsDq^%6u@FoDMJacLWtCX7jZxbFc_?2 mWngHK`2KIMH&~K^;fMv$8T+eyk`x>!G+)|V|DTD8!5RQaJghJP diff --git a/docs/reference/images/callouts/1.png b/docs/reference/images/callouts/1.png deleted file mode 100644 index 7d473430b7bec514f7de12f5769fe7c5859e8c5d..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 329 zcmeAS@N?(olHy`uVBq!ia0vp^JRr;gBp8b2n5}^nQC}X^4DKU-G|w_t}fLBA)Suv#nrW z!^h2QnY_`l!BOq-UXEX{m2up>JTQkX)2m zTvF+fTUlI^nXH#utd~++ke^qgmzgTe~DWM4ffP81J diff --git a/docs/reference/images/callouts/10.gif b/docs/reference/images/callouts/10.gif deleted file mode 100644 index fb50b06d150685fbc333906361e32afbf7684993..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 968 zcmV;(12_CfNk%w1VGIBa0QUd@000010RaL60s{jB1Ox;H1qB8M1_uWR2nYxX2?+`c z3JVJh3=9kn4Gj(s4i66x5D*X%5fKs+5)%^>6ciK{6%`g178e&67#J8C85tTH8XFrM z92^`S9UUGX9v>ecARr(iAt53nA|oRsBqSsyB_$>%CMPE+C@3f?DJd!{Dl021EG#T7 zEiEoCE-x=HFfcGNF)=bSGBYzXG&D3dH8nOiHa9mnI5;>tIXOByIy*Z%JUl!-Jv}}? zK0iM{KtMo2K|w-7LPJACL_|bIMMXwNMn^|SNJvOYNl8jdN=r*iOiWBoO-)WtPESuy zP*6}&QBhJ-Qd3h?R8&+|RaI72R##V7SXfwDSy@_IT3cINTwGjTU0q&YUSD5dU|?Wj zVPRroVq;@tWMpJzWo2e&W@l$-XlQ6@X=!R|YHMq2Y;0_8ZEbFDZf|dIaBy&OadC2T za&vQYbaZreb#-=jc6WDoczAeud3kzzdV70&e0+R;eSLm@et&;|fPjF3fq{a8f`fyD zgoK2Jg@uNOhKGlTh=_=ZiHVAeii?YjjEszpjg5|uj*pLzkdTm(k&%*;l9Q8@l$4Z} zm6ev3mY0{8n3$NEnVFiJnwy)OoSdAUot>VZo}ZteprD|kp`oIpqNAguq@<*!rKP5( zrl+T;sHmu^si~@}s;jH3tgNi9t*x%EuCK4Ju&}VPv9YqUva_?Zw6wIfwY9dkwzs#p zxVX5vxw*Q!y1To(yu7@dCU$jHda z$;ryf%FD~k%*@Qq&CSlv&d<-!(9qD)(b3Y<($mw^)YR0~)z#M4*4Nk9*x1lt)=I7_<=;-L_>FMg~>g((4 z?Ck9A?d|UF?(gsK@bK{Q@$vHV^7Hfa^z`)g_4W4l_V@Sq`1ttw`T6?#`uqF){QUg= z{r&#_{{R2~A^8LV0RR91EC2ui01N;O000Q30RR2_$0-K}2ss$t`}gnPyBrWO06>re zLJV*J{^dYWt5yncz0OHVaj#T}cmHbDss&(<}jYB?hWAjdxpF-idd;H(xSYY-?o1HkBC4gkG4 qLFjeQT8tF;{=Lfq000002mqw;_V3@nf0S|{K#+pcy?_4#0suRd diff --git a/docs/reference/images/callouts/10.png b/docs/reference/images/callouts/10.png deleted file mode 100644 index 997bbc8246a316e040e0804174ba260e219d7d33..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 361 zcmeAS@N?(olHy`uVBq!ia0vp^JRr;gBp8b2n5}^nQWtZ~+OvdJMW|Y+^UT?O-M{rKJsmzxdayJ{ zDCQA!%%@7Jj$q%-wf8e0_jRx8Dqi$}^?K=?6FriQFLv>>oc^CE+aVHhW3=nZ+fQ4!M=ZC7H>3sl|FJr3LwU zC3?yExf6FO?f@F61vV}-Juk7O6lk8Yg;}bFaZ-|HQc7Azopr01?u8M*si- diff --git a/docs/reference/images/callouts/11.gif b/docs/reference/images/callouts/11.gif deleted file mode 100644 index 9f5dba4f8df99fff77747affe9c6c03492ec896b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 244 zcmZ?wbhEHb*_Mn*=~*4EC>&cVUKsi~=%nVHqq z)opEU{r&yZr%#_dckZG^i`K1Mw|VpC9Xoa$IdbIe*|V1}UAley_T$Ho-@JMA;lqc2 z|Neo@1p~#OEDVf5mJWyqvXgP}^2;9)OfJm7I)A)~{gLS`_d;ZPy>0S|_X3{XE z)7O>#600DeuDZ?5tOl@ql94%{~0TwC?8m~C^ZqJRG}m@H-L1 z5L@scq?{XUcxG{OP9jig5ySQaTl#^*93bKF#G<^+ymW>G($Cs~V(bw8rA5i93}62@ zzlJGu&d<$F%`0K}c4pdspcorSSx9C{PAbEScbC)|7#JBmT^vIy=9KoYUDZ+`aP)jU z&ny=ErrK^#Gw!AcR}pdfMERuV^@&0$@(#^6b8c@rn^6RWX3pUb z4*6@PZ+H0#u=rjsXzS?6n6*sBGbHqGTU%mCsH?n#%j;eD^2}qe=iX*J@VQ3BRpz+u z{PX#N(^9X${`$90+;!pWs>o@z_n8G)7Uo7PJz`jrS+)QE@=PWHmc~UIw=WmUe73o7 z>^bR(M752aYoNg~ozu7U7&{(U>{s!;bn#f?ItjL^o`e{*EOQHqO;ccnz9hLK5@2cAyw@AaPFL~Cp#02|E|4xeQteNtB7waMs QVCXP-y85}Sb4q9e0GRUFb^rhX diff --git a/docs/reference/images/callouts/12.gif b/docs/reference/images/callouts/12.gif deleted file mode 100644 index a373d0b4f4203dc34d00cfc337fce3c6940ac0a5..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 244 zcmZ?wbhEHb2m08OKLyy@67BNn1 zV`M$b;Hb*j&z8jCVAzz(*|0d1*}-svnJ2^2O#T7^_7xgl3o~c6fy_O;6lj#|@c@$< P%QAt6&q75}91PX~p`BKN diff --git a/docs/reference/images/callouts/12.png b/docs/reference/images/callouts/12.png deleted file mode 100644 index 31daf4e2f25b6712499ee32de9c2e3b050b691ca..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 617 zcmeAS@N?(olHy`uVBq!ia0vp^JRr=$1SD^YpWXnZI14-?iy0V%N{XE z)7O>#600De9$%>2LVd81Yeb1-X-P(Y5yQ%LXFPyHJS9LOm(=3qqRfJl%=|nCVNOM5 zpg0#u+&RCXvM4h>ql94%{~0TwC?8m~C^ZqJRG}m@H-L1 z5L@scq?{XUcxG{OP9jig5ySQaTl#^*93bKF#G<^+ymW>G($Cs~V(bw8rA5i93}62@ zzlJGu&d<$F%`0K}c4pdspcorSSx9C{PAbEScbC)|7#JBmT^vIy=Cn>wTzx1(qV@bS z0hYvspf(--lM>otrqbK$7p{3DzJ|+KN8%5ows)AI?zWk_n>jwEHXrTJecpEW_0xL= z?}N`*R`T~d2{AN${y8T#GEn4hUb&52^}Op@TW4{oc)A6)%$5=G}h# z?O{QLj@aRcAIf&y&OiUN=H2gq=_}V|pWfuReDV|{jwXw~>#w)I|9$3x|moMMCb?eciM{nM|`S|hUzkmNgCL#gF zpDYZFK)w!03}hz*YvF=rnZlC|CNImJwM-Kz+OQ~d)-w*#q=p-*7PHz|r?uJeim=Ww zV{C0@=>Ntrnaz(OL9u;eM8lFu#sozHRo??kGr1dh7*7~9Ey|P%1DVSLG^)+=Sc1ij PWtl+3XQ84f4hCxgsBBm& diff --git a/docs/reference/images/callouts/13.png b/docs/reference/images/callouts/13.png deleted file mode 100644 index 14021a89c2ed3d4881afea6e3a315bce4f95efce..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 623 zcmeAS@N?(olHy`uVBq!ia0vp^JRr=$1SD^YpWXnZI14-?iy0V%N{XE z)7O>#600Dep5bGK9wD%hYeb1-X-P(Y5yQ%LXFPyHJS9LOm(=3qqRfJl%=|nCVNOM5 zpg0#u+&RCXvM4h>ql94%{~0TwC?8m~C^ZqJRG}m@H-L1 z5L@scq?{XUcxG{OP9jig5ySQaTl#^*93bKF#G<^+ymW>G($Cs~V(bw8rA5i93}62@ zzlJGu&d<$F%`0K}c4pdspcorSSx9C{PAbEScbC)|7#JBmT^vIy=Cn>w>~AWNX^a2R zbkveVY|45D7UnZ&JtjPwvdCCscZp0EA*0()#GOw)UH4-^&)y^E*4%UC)*|J}q_Ss;tN`nd8$>x9$_Xb^O2EpX&@C ZI46EzbLxq-voTO7gQu&X%Q~loCIF_C`w;*D diff --git a/docs/reference/images/callouts/14.gif b/docs/reference/images/callouts/14.gif deleted file mode 100644 index 6d6642ee96d73aa5b2efe17277f15c63e15ff643..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 244 zcmZ?wbhEHbgv_2w{G2f{P^+Pw{Jgw{P^$RKag>#K=CIF z10zsK2P6!#lYzA`VOnY=t7jyToEFN;z;JkSYGfEE2V(<6l11b+S?_5KEX!CT+8F(( zvRqlp;LjGuAfVc->c}`bkwHN5baLRK$*JrYWEePfJPT4IRYB%D08MZc1e)(ZEfr|E OB-C)A`C!DsU=08}Mo-uP diff --git a/docs/reference/images/callouts/14.png b/docs/reference/images/callouts/14.png deleted file mode 100644 index 64014b75fe2e84d45ed861974c72462727979360..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 411 zcmV;M0c8G(P)!ax*-PXaQ9e~6^e1gu=a6a&KSz}bR`+prYG9ayB$BDjWGfIE;t#wl!+ zR3S(jA%y#i_@eOOedXoc%RQe%L;wH~k+s%ZI~)!<=dD%?4MaplaU9QPGski2q3`>r z(}{j@0a$CLl+)={2vLWml*i-oa5#J}DW$gCZB~Z!(!M#)2St|1_V^0qpmCrBof=Y&NUas@LmfSw=)4B4f;8Fu)(eFsv24 zJzXxBrayquXcR?Ji+1bU# z#kIAy&CSg{Jw1~rPo6n*=86?7wrtt5XV0EPhYnr2a^>dDn-3m5c>DJ4moH!b{rd+p z6b2N3vM?|LIXWN#kev*yg%7sn&Q|rkxh?nhwpdmMhK9|#x2N%XFg5sYwz$1bx0{Xk z_GO0a+gN$Os>~K+Jja&BAYj`ToN;JVE|Y+*Pie-X&AB`WbeJq+xeIcm-9YAoOlVUC XntyRyF3|Aku*lmW!=WgegTWdA>{?yt diff --git a/docs/reference/images/callouts/15.png b/docs/reference/images/callouts/15.png deleted file mode 100644 index 0d65765fcf13dcfd87914744dec8bda115e4adf1..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 640 zcmeAS@N?(olHy`uVBq!ia0vp^JRr=$1SD^YpWXnZI14-?iy0V%N{XE z)7O>#600De0j~t#c`vY#Yeb1-X-P(Y5yQ%LXFPyHJS9LOm(=3qqRfJl%=|nCVNOM5 zpg0#u+&RCXvM4h>ql94%{~0TwC?8m~C^ZqJRG}m@H-L1 z5L@scq?{XUcxG{OP9jig5ySQaTl#^*93bKF#G<^+ymW>G($Cs~V(bw8rA5i93}62@ zzlJGu&d<$F%`0K}c4pdspcorSSx9C{PAbEScbC)|7#JBmT^vIy=9Eq_Jl&Ka(%QdX zh{H8O%#_7)Tc@t$mM`p4(Ne7omR*~(>gd8_8AZH{=3ms$Fmzm^yL@_+(#aQQ5>7QW z>3g2fIsH(ugM)!V$x4Rr_+!J_XU%4xbz0aE;^N{m@42Z|@0S@TQ=WbP`TMV5Ok;<| z^Ihv+@6tQ{sciRF9dD7Nr=KobwJJ68zJK$<1Pd9rz%4O)*;}Jzj&~nTGMecz>B%lV zK|`fmIc8mp-h8iSXiGFW=C(L+XH4DRxZQX87^-dLuD>odo6YLT@Sw)dfBEIG)v2@6 zR)%mL7GRj1x-&v&+2q@A%a&h0`Lw7|#(w_!tgT!PoJ|+re`l6ciK{6%`g178e&67#J8C85tTH8XFrM z92^`S9UUGX9v>ecARr(iAt53nA|oRsBqSsyB_$>%CMPE+C@3f?DJd!{Dl021EG#T7 zEiEoCE-x=HFfcGNF)=bSGBYzXG&D3dH8nOiHa9mnI5;>tIXOByIy*Z%JUl!-Jv}}? zK0iM{KtMo2K|w-7LPJACL_|bIMMXwNMn^|SNJvOYNl8jdN=r*iOiWBoO-)WtPESuy zP*6}&QBhJ-Qd3h?R8&+|RaI72R##V7SXfwDSy@_IT3cINTwGjTU0q&YUSD5dU|?Wj zVPRroVq;@tWMpJzWo2e&W@l$-XlQ6@X=!R|YHMq2Y;0_8ZEbFDZf|dIaBy&OadC2T za&vQYbaZreb#-=jc6WDoczAeud3kzzdV70&e0+R;eSLm@et&;|fPjF3fq{a8f`fyD zgoK2Jg@uNOhKGlTh=_=ZiHVAeii?YjjEszpjg5|uj*pLzkdTm(k&%*;l9Q8@l$4Z} zm6ev3mY0{8n3$NEnVFiJnwy)OoSdAUot>VZo}ZteprD|kp`oIpqNAguq@<*!rKP5( zrl+T;sHmu^si~@}s;jH3tgNi9t*x%EuCK4Ju&}VPv9YqUva_?Zw6wIfwY9dkwzs#p zxVX5vxw*Q!y1To(yu7@dCU$jHda z$;ryf%FD~k%*@Qq&CSlv&d<-!(9qD)(b3Y<($mw^)YR0~)z#M4*4Nk9*x1lt)=I7_<=;-L_>FMg~>g((4 z?Ck9A?d|UF?(gsK@bK{Q@$vHV^7Hfa^z`)g_4W4l_V@Sq`1ttw`T6?#`uqF){QUg= z{r&#_{{R2~A^8LV0RR91EC2ui01N;O000Q30RR2FM=1vc2st?2`}gnPxflQdqzC~3 zK#X($?!^EQ!rHla#vlNQagPxI0Hv$}2yu@Q004|)006*f4*&q(Y5@Qc0|5X40001p zac>R)001^@s67~R_g00000F&F^=u;$*F7%?ya0Kn*83;>+Y qojZ4K4}ci={+){f00000006`|_wV1odyHZrK#+sdy?_4#0suS0gSs35 diff --git a/docs/reference/images/callouts/2.png b/docs/reference/images/callouts/2.png deleted file mode 100644 index 5d09341b2f6d2ea2d1d5dad5d980f14b4b05dfd2..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 353 zcmeAS@N?(olHy`uVBq!ia0vp^JRr;gBp8b2n5}^nQxaY7e*=hH)_rZeB4|imU1$R#1`!P>&$poQl;nzm}mD5ZFopaX|GsS%q*{P~< z;WtmO%lhToBL0i}yfkaOt?EN=nkLNGuU`ywhI5H)L`iUdT1k0gQ7VIjhO(w-Zen_> zZ(@38a<+nro{^q~f~BRtfrY+-p+a&|W^qZSLvCepNoKNMYO!8QX+eHoiC%Jk?!;Y+ zJAlS%fsM;d&r2*R1)67JkeZlkYGj#gX_9E3W@4U_nw*@Ln38B@k(iuhnUeN2e6ciK{6%`g178e&67#J8C85tTH8XFrM z92^`S9UUGX9v>ecARr(iAt53nA|oRsBqSsyB_$>%CMPE+C@3f?DJd!{Dl021EG#T7 zEiEoCE-x=HFfcGNF)=bSGBYzXG&D3dH8nOiHa9mnI5;>tIXOByIy*Z%JUl!-Jv}}? zK0iM{KtMo2K|w-7LPJACL_|bIMMXwNMn^|SNJvOYNl8jdN=r*iOiWBoO-)WtPESuy zP*6}&QBhJ-Qd3h?R8&+|RaI72R##V7SXfwDSy@_IT3cINTwGjTU0q&YUSD5dU|?Wj zVPRroVq;@tWMpJzWo2e&W@l$-XlQ6@X=!R|YHMq2Y;0_8ZEbFDZf|dIaBy&OadC2T za&vQYbaZreb#-=jc6WDoczAeud3kzzdV70&e0+R;eSLm@et&;|fPjF3fq{a8f`fyD zgoK2Jg@uNOhKGlTh=_=ZiHVAeii?YjjEszpjg5|uj*pLzkdTm(k&%*;l9Q8@l$4Z} zm6ev3mY0{8n3$NEnVFiJnwy)OoSdAUot>VZo}ZteprD|kp`oIpqNAguq@<*!rKP5( zrl+T;sHmu^si~@}s;jH3tgNi9t*x%EuCK4Ju&}VPv9YqUva_?Zw6wIfwY9dkwzs#p zxVX5vxw*Q!y1To(yu7@dCU$jHda z$;ryf%FD~k%*@Qq&CSlv&d<-!(9qD)(b3Y<($mw^)YR0~)z#M4*4Nk9*x1lt)=I7_<=;-L_>FMg~>g((4 z?Ck9A?d|UF?(gsK@bK{Q@$vHV^7Hfa^z`)g_4W4l_V@Sq`1ttw`T6?#`uqF){QUg= z{r&#_{{R2~A^8LV0RR91EC2ui01N;O000Q30RR2FM=1vc2st?2`}gnPxflQtl zK#X($?!^EA!J9R2&L9AYagPxI0CUbEfbee(004|)0000X1po;D)&Kwy0|5X4006W) zXAJ=W001^@tB7y$s_tQG(OF&F^=!026!9PbDL0Kn*83;+;X q-MiNc0e~3y{+&w!00062006`|_wV1odyHZrfDnVyy?_4#0suROfV)2c diff --git a/docs/reference/images/callouts/3.png b/docs/reference/images/callouts/3.png deleted file mode 100644 index ef7b70047158970cf4e09f1bab2954d39c2d596b..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 350 zcmeAS@N?(olHy`uVBq!ia0vp^JRr;gBp8b2n5}^nQF0kK0(Y1u|9Rc(19XFPiEBhjaDG}zd16s2gM)^$re|(qda7?? zdS-IAf{C7yo`r&?rM`iMzJZ}aa#3b+Nu@(>WpPPnvR-PjUP@^}eqM=Qa(?c_U5Yz^ z#%Y0#%S_KpEGY$=XJL?(l#*ybuErX#^g`ttQfwn6ciK{6%`g178e&67#J8C85tTH8XFrM z92^`S9UUGX9v>ecARr(iAt53nA|oRsBqSsyB_$>%CMPE+C@3f?DJd!{Dl021EG#T7 zEiEoCE-x=HFfcGNF)=bSGBYzXG&D3dH8nOiHa9mnI5;>tIXOByIy*Z%JUl!-Jv}}? zK0iM{KtMo2K|w-7LPJACL_|bIMMXwNMn^|SNJvOYNl8jdN=r*iOiWBoO-)WtPESuy zP*6}&QBhJ-Qd3h?R8&+|RaI72R##V7SXfwDSy@_IT3cINTwGjTU0q&YUSD5dU|?Wj zVPRroVq;@tWMpJzWo2e&W@l$-XlQ6@X=!R|YHMq2Y;0_8ZEbFDZf|dIaBy&OadC2T za&vQYbaZreb#-=jc6WDoczAeud3kzzdV70&e0+R;eSLm@et&;|fPjF3fq{a8f`fyD zgoK2Jg@uNOhKGlTh=_=ZiHVAeii?YjjEszpjg5|uj*pLzkdTm(k&%*;l9Q8@l$4Z} zm6ev3mY0{8n3$NEnVFiJnwy)OoSdAUot>VZo}ZteprD|kp`oIpqNAguq@<*!rKP5( zrl+T;sHmu^si~@}s;jH3tgNi9t*x%EuCK4Ju&}VPv9YqUva_?Zw6wIfwY9dkwzs#p zxVX5vxw*Q!y1To(yu7@dCU$jHda z$;ryf%FD~k%*@Qq&CSlv&d<-!(9qD)(b3Y<($mw^)YR0~)z#M4*4Nk9*x1lt)=I7_<=;-L_>FMg~>g((4 z?Ck9A?d|UF?(gsK@bK{Q@$vHV^7Hfa^z`)g_4W4l_V@Sq`1ttw`T6?#`uqF){QUg= z{r&#_{{R2~A^8LV0RR91EC2ui01N;O000Q30RR2_*Gfu?6iQ0{`}gnPJtY7D07wA= zK#p_&{wVRjGG#0000G0|Nj6TFybZ zHwOR!00=Mu2=Q)CihGPO004kM34k&G{{8#+uM_|PF-idd0001hdvgE)0Kn*84gdfE q0Pwa30Du(t{=Lfq00000005-$_V3@ndz@lGKoEn`y?_4#0suSSP`y|H diff --git a/docs/reference/images/callouts/4.png b/docs/reference/images/callouts/4.png deleted file mode 100644 index adb8364eb5d21ecdd4086e16110b62ddcb42aa4a..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 345 zcmeAS@N?(olHy`uVBq!ia0vp^JRr;gBp8b2n5}^nQ3r>K)tuC)r#2`iJ>Prt42#Ndx#Uc~1)>aw z3jE@Q4|!9Z%lVv}- zc=48cF7H)t`(Ck`^+mtha~Np7bBSw2NpOBzNqJ&XDuaWDvZiNlVtT4?VtQtBwt|VC zk)DNurKP@sg}#BILUK`NaY>~^Ze?*vX0l#tv0h4PL4IC|UUGi!#9fLzfW~Qojmu2W zODrh`nrE42VU(7fm~5G9U~HM3l#*m_WNcxOXkuz6ciK{6%`g178e&67#J8C85tTH8XFrM z92^`S9UUGX9v>ecARr(iAt53nA|oRsBqSsyB_$>%CMPE+C@3f?DJd!{Dl021EG#T7 zEiEoCE-x=HFfcGNF)=bSGBYzXG&D3dH8nOiHa9mnI5;>tIXOByIy*Z%JUl!-Jv}}? zK0iM{KtMo2K|w-7LPJACL_|bIMMXwNMn^|SNJvOYNl8jdN=r*iOiWBoO-)WtPESuy zP*6}&QBhJ-Qd3h?R8&+|RaI72R##V7SXfwDSy@_IT3cINTwGjTU0q&YUSD5dU|?Wj zVPRroVq;@tWMpJzWo2e&W@l$-XlQ6@X=!R|YHMq2Y;0_8ZEbFDZf|dIaBy&OadC2T za&vQYbaZreb#-=jc6WDoczAeud3kzzdV70&e0+R;eSLm@et&;|fPjF3fq{a8f`fyD zgoK2Jg@uNOhKGlTh=_=ZiHVAeii?YjjEszpjg5|uj*pLzkdTm(k&%*;l9Q8@l$4Z} zm6ev3mY0{8n3$NEnVFiJnwy)OoSdAUot>VZo}ZteprD|kp`oIpqNAguq@<*!rKP5( zrl+T;sHmu^si~@}s;jH3tgNi9t*x%EuCK4Ju&}VPv9YqUva_?Zw6wIfwY9dkwzs#p zxVX5vxw*Q!y1To(yu7@dCU$jHda z$;ryf%FD~k%*@Qq&CSlv&d<-!(9qD)(b3Y<($mw^)YR0~)z#M4*4Nk9*x1lt)=I7_<=;-L_>FMg~>g((4 z?Ck9A?d|UF?(gsK@bK{Q@$vHV^7Hfa^z`)g_4W4l_V@Sq`1ttw`T6?#`uqF){QUg= z{r&#_{{R2~A^8LV0RR91EC2ui01N;O000Q30RR2_$0-K}2ss$t`}gnPyBr8oqzI7$ zK@4yI{^bCW<{Pv;Y7==^Ow6F-idd5aXYc5Z)*O0Kn*94gdfM qy}MTm0)Q0v{=Lfq00066005-$_V3@nf0S|{KoEn`y?_4#0suQhF}%G1 diff --git a/docs/reference/images/callouts/5.png b/docs/reference/images/callouts/5.png deleted file mode 100644 index 4d7eb460021e845981861d77614539314f553993..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 348 zcmeAS@N?(olHy`uVBq!ia0vp^JRr;gBp8b2n5}^nQEX4g z+-vfUhb0A>b04=Im{6XiQd1v%r%>h0$G8U7E1If8OQ!N~xOYY5h0NDT$p9(iZ?Q&e z18-(+l~J8O`)kc}e&uL$eW&>P-#`~Qm$*ih1m~xflqVLYGB{``YkKA;rl!p+yCFkc(+@-h!Xq*<< zxXkpt#FA2=d1VEBsYynrsitN|Y01eJ$;p;U#>wWX2KP5v&I9V=1L+C? fTFYQ)RAFeOZJ=$?lDoSWD8u0C>gTe~DWM4f^}upZ diff --git a/docs/reference/images/callouts/6.gif b/docs/reference/images/callouts/6.gif deleted file mode 100644 index d39640707444f5f67b2cd324143c2d6b40d27a40..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 968 zcmV;(12_CfNk%w1VGIBa0QUd@000010RaL60s{jB1Ox;H1qB8M1_uWR2nYxX2?+`c z3JVJh3=9kn4Gj(s4i66x5D*X%5fKs+5)%^>6ciK{6%`g178e&67#J8C85tTH8XFrM z92^`S9UUGX9v>ecARr(iAt53nA|oRsBqSsyB_$>%CMPE+C@3f?DJd!{Dl021EG#T7 zEiEoCE-x=HFfcGNF)=bSGBYzXG&D3dH8nOiHa9mnI5;>tIXOByIy*Z%JUl!-Jv}}? zK0iM{KtMo2K|w-7LPJACL_|bIMMXwNMn^|SNJvOYNl8jdN=r*iOiWBoO-)WtPESuy zP*6}&QBhJ-Qd3h?R8&+|RaI72R##V7SXfwDSy@_IT3cINTwGjTU0q&YUSD5dU|?Wj zVPRroVq;@tWMpJzWo2e&W@l$-XlQ6@X=!R|YHMq2Y;0_8ZEbFDZf|dIaBy&OadC2T za&vQYbaZreb#-=jc6WDoczAeud3kzzdV70&e0+R;eSLm@et&;|fPjF3fq{a8f`fyD zgoK2Jg@uNOhKGlTh=_=ZiHVAeii?YjjEszpjg5|uj*pLzkdTm(k&%*;l9Q8@l$4Z} zm6ev3mY0{8n3$NEnVFiJnwy)OoSdAUot>VZo}ZteprD|kp`oIpqNAguq@<*!rKP5( zrl+T;sHmu^si~@}s;jH3tgNi9t*x%EuCK4Ju&}VPv9YqUva_?Zw6wIfwY9dkwzs#p zxVX5vxw*Q!y1To(yu7@dCU$jHda z$;ryf%FD~k%*@Qq&CSlv&d<-!(9qD)(b3Y<($mw^)YR0~)z#M4*4Nk9*x1lt)=I7_<=;-L_>FMg~>g((4 z?Ck9A?d|UF?(gsK@bK{Q@$vHV^7Hfa^z`)g_4W4l_V@Sq`1ttw`T6?#`uqF){QUg= z{r&#_{{R2~A^8LV0RR91EC2ui01N;O000Q30RR2_*Gfu?6iQ0{`}gnPJtY7DU`PP~ zK#p_&{wV<}SN&x`ij1T|-F-iddu;yKe5ciY-0Kn*84gdfs q-MdE!0Du(t{=Lfq00066005-$_V3@ndz^A0KoEn`y?_4#0suR2o4}_4 diff --git a/docs/reference/images/callouts/6.png b/docs/reference/images/callouts/6.png deleted file mode 100644 index 0ba694af6c07d947d219b45a629bd32c60a0f5fe..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 355 zcmeAS@N?(olHy`uVBq!ia0vp^JRr;gBp8b2n5}^nQ*)Bra@SU# zmiz#bR~{$s2si{S(aY|Z}Vd7tb ouUmn-_&~Y>fYve?8dVq?X&Y!8wB+ut16ciK{6%`g178e&67#J8C85tTH8XFrM z92^`S9UUGX9v>ecARr(iAt53nA|oRsBqSsyB_$>%CMPE+C@3f?DJd!{Dl021EG#T7 zEiEoCE-x=HFfcGNF)=bSGBYzXG&D3dH8nOiHa9mnI5;>tIXOByIy*Z%JUl!-Jv}}? zK0iM{KtMo2K|w-7LPJACL_|bIMMXwNMn^|SNJvOYNl8jdN=r*iOiWBoO-)WtPESuy zP*6}&QBhJ-Qd3h?R8&+|RaI72R##V7SXfwDSy@_IT3cINTwGjTU0q&YUSD5dU|?Wj zVPRroVq;@tWMpJzWo2e&W@l$-XlQ6@X=!R|YHMq2Y;0_8ZEbFDZf|dIaBy&OadC2T za&vQYbaZreb#-=jc6WDoczAeud3kzzdV70&e0+R;eSLm@et&;|fPjF3fq{a8f`fyD zgoK2Jg@uNOhKGlTh=_=ZiHVAeii?YjjEszpjg5|uj*pLzkdTm(k&%*;l9Q8@l$4Z} zm6ev3mY0{8n3$NEnVFiJnwy)OoSdAUot>VZo}ZteprD|kp`oIpqNAguq@<*!rKP5( zrl+T;sHmu^si~@}s;jH3tgNi9t*x%EuCK4Ju&}VPv9YqUva_?Zw6wIfwY9dkwzs#p zxVX5vxw*Q!y1To(yu7@dCU$jHda z$;ryf%FD~k%*@Qq&CSlv&d<-!(9qD)(b3Y<($mw^)YR0~)z#M4*4Nk9*x1lt)=I7_<=;-L_>FMg~>g((4 z?Ck9A?d|UF?(gsK@bK{Q@$vHV^7Hfa^z`)g_4W4l_V@Sq`1ttw`T6?#`uqF){QUg= z{r&#_{{R2~A^8LV0RR91EC2ui01N;O000Q30RR2_S4&EY6iQm%`}gnPJt+_{K)?V2 zLXLC){%HZw>fgVA|EvLsajzEu00000z;I3r005M<000000DxM(0001xBL)Bf002n2 z7XttQ00?3L0001hwORlG004kM3jhEBa{QA500000F=_z-0D#dw1ONa40Kn*<5&!^d q)dBzj0Du(t{=E|d00000005*o_wV1of1Gk4K#+pby?_4#0suR4=(v0U diff --git a/docs/reference/images/callouts/7.png b/docs/reference/images/callouts/7.png deleted file mode 100644 index 472e96f8ac36862c5645732f2fff19d06ee11a8e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 344 zcmeAS@N?(olHy`uVBq!ia0vp^JRr;gBp8b2n5}^nQu%w%U~xZhnMEEs6JbBSw2NpOBzNqJ&XDuaWDvZiNlVtT4?VtQtBwt|VC zk)DNurKP@sg}#BILUK`NaY>~^Ze?*vX0l#tv0h4PL4IC|UUGi!#9fLzfW~Qojmu2W zODrh`nrCEbVQgk$XkwI@Y+{_8nv`N>YGIaQkz#0QY@Te9lBQ<)awbq0A4pdK&{_sV bqY6VKZ3AtCmfYR7Kp6&4S3j3^P66ciK{6%`g178e&67#J8C85tTH8XFrM z92^`S9UUGX9v>ecARr(iAt53nA|oRsBqSsyB_$>%CMPE+C@3f?DJd!{Dl021EG#T7 zEiEoCE-x=HFfcGNF)=bSGBYzXG&D3dH8nOiHa9mnI5;>tIXOByIy*Z%JUl!-Jv}}? zK0iM{KtMo2K|w-7LPJACL_|bIMMXwNMn^|SNJvOYNl8jdN=r*iOiWBoO-)WtPESuy zP*6}&QBhJ-Qd3h?R8&+|RaI72R##V7SXfwDSy@_IT3cINTwGjTU0q&YUSD5dU|?Wj zVPRroVq;@tWMpJzWo2e&W@l$-XlQ6@X=!R|YHMq2Y;0_8ZEbFDZf|dIaBy&OadC2T za&vQYbaZreb#-=jc6WDoczAeud3kzzdV70&e0+R;eSLm@et&;|fPjF3fq{a8f`fyD zgoK2Jg@uNOhKGlTh=_=ZiHVAeii?YjjEszpjg5|uj*pLzkdTm(k&%*;l9Q8@l$4Z} zm6ev3mY0{8n3$NEnVFiJnwy)OoSdAUot>VZo}ZteprD|kp`oIpqNAguq@<*!rKP5( zrl+T;sHmu^si~@}s;jH3tgNi9t*x%EuCK4Ju&}VPv9YqUva_?Zw6wIfwY9dkwzs#p zxVX5vxw*Q!y1To(yu7@dCU$jHda z$;ryf%FD~k%*@Qq&CSlv&d<-!(9qD)(b3Y<($mw^)YR0~)z#M4*4Nk9*x1lt)=I7_<=;-L_>FMg~>g((4 z?Ck9A?d|UF?(gsK@bK{Q@$vHV^7Hfa^z`)g_4W4l_V@Sq`1ttw`T6?#`uqF){QUg= z{r&#_{{R2~A^8LV0RR91EC2ui01N;O000Q30RR2_*Gfu?5K>D0`}gnPJ0$=BKnMW< zK#p_&{s{p9pp-Xjy&wRHajz5r07~vb0B~*&005Mf001E59s~sM)&Kwy0|Nj60BW7{ zW(@%V00=Mu0HEcb6eaK0004kM2><}4dI12?suutNF-iddFy~#05a$R106^)V5C8}$ qoqIu&S`V$cAh@R~F=4@V4jxkzlaQrcFYWK{)(`o5XZnut z=nE4SU2g1ZW%;@@I$>_e3F8a=8WK~|CVXt1DqisQxtIX|`YW_n&?Nh#1gQ}d)$LrYTw(_{nVG)tp2V+#}WG*e^KRLdkoLz7g? qn(IA84Qgo42`r6v<+Hvch>@C7(8A5T-G@yGywn*$#_oy diff --git a/docs/reference/images/callouts/9.gif b/docs/reference/images/callouts/9.gif deleted file mode 100644 index bc5c8125b03849986c2df04f65f7406235c700a6..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 968 zcmV;(12_CfNk%w1VGIBa0QUd@000010RaL60s{jB1Ox;H1qB8M1_uWR2nYxX2?+`c z3JVJh3=9kn4Gj(s4i66x5D*X%5fKs+5)%^>6ciK{6%`g178e&67#J8C85tTH8XFrM z92^`S9UUGX9v>ecARr(iAt53nA|oRsBqSsyB_$>%CMPE+C@3f?DJd!{Dl021EG#T7 zEiEoCE-x=HFfcGNF)=bSGBYzXG&D3dH8nOiHa9mnI5;>tIXOByIy*Z%JUl!-Jv}}? zK0iM{KtMo2K|w-7LPJACL_|bIMMXwNMn^|SNJvOYNl8jdN=r*iOiWBoO-)WtPESuy zP*6}&QBhJ-Qd3h?R8&+|RaI72R##V7SXfwDSy@_IT3cINTwGjTU0q&YUSD5dU|?Wj zVPRroVq;@tWMpJzWo2e&W@l$-XlQ6@X=!R|YHMq2Y;0_8ZEbFDZf|dIaBy&OadC2T za&vQYbaZreb#-=jc6WDoczAeud3kzzdV70&e0+R;eSLm@et&;|fPjF3fq{a8f`fyD zgoK2Jg@uNOhKGlTh=_=ZiHVAeii?YjjEszpjg5|uj*pLzkdTm(k&%*;l9Q8@l$4Z} zm6ev3mY0{8n3$NEnVFiJnwy)OoSdAUot>VZo}ZteprD|kp`oIpqNAguq@<*!rKP5( zrl+T;sHmu^si~@}s;jH3tgNi9t*x%EuCK4Ju&}VPv9YqUva_?Zw6wIfwY9dkwzs#p zxVX5vxw*Q!y1To(yu7@dCU$jHda z$;ryf%FD~k%*@Qq&CSlv&d<-!(9qD)(b3Y<($mw^)YR0~)z#M4*4Nk9*x1lt)=I7_<=;-L_>FMg~>g((4 z?Ck9A?d|UF?(gsK@bK{Q@$vHV^7Hfa^z`)g_4W4l_V@Sq`1ttw`T6?#`uqF){QUg= z{r&#_{{R2~A^8LV0RR91EC2ui01N;O000Q30RR2_*Gfu?5K>y*`}gnPJs|)9K!5-M zK#q6+{wV=~pp~_Ar2qiPajz8s0CT({z;I6s005Mf002;`6#xL%N&x_n0|Nj6d%PjQ zaIY5t00=Mu005!ayL0Di0RVtN2mk;85FkKcjS>I=F-iddAmm;MCI4~&0Kn*84gdgJ q{d>0t0Du(t{=JI<00062006}B_V3@nf0SZCKoEn`y?_4#0suSwcfTJ1 diff --git a/docs/reference/images/callouts/9.png b/docs/reference/images/callouts/9.png deleted file mode 100644 index a0676d26cc2ff1de12c4ecdeefb44a0d71bc6bde..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 357 zcmeAS@N?(olHy`uVBq!ia0vp^JRr;gBp8b2n5}^nQNRqa;^5&H%t0&v*|C|wdb9$wI zR@+N9#RIowg@Uqn&z-__Tzhhz!sG|vTxA7?=O|Y?u(d4T{!RM9c7chr6d%1?R=i16 z?@Ic{f32YJFJnVhX)qGzOMplv!L->5yAlT#}irms+fsQd*FoSE84k zpF44v;trs3T43Wc)AJHbN`dAXo0u6Hr<$gkq?lM38ycjV7+5A5Sr{ayr5c%-n;95g pF*H#D>f!_G3IJNmU}#ifXryhRZP1dtyA~+J;OXk;vd$@?2>@J{cB%jX diff --git a/docs/reference/src/images/logo.gif b/docs/reference/src/images/logo.gif deleted file mode 100644 index 38bac7e01aad63fb8cb1062540e723eeae2a06df..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 22790 zcmWh!d033^`+eVc_NAKkX`fc@O?xSs_Gyu6Pm8A2sAQ655TAFJ7VRmD!bFlJQ$iA^ zeUVHQp_pU|MfNOT{rvuU{(i3exzBZ<`<(Om`uR9HCx}1__yYh|S68Xj;|p&_Xlt<2i8iv|o_T%FhKTdF#Tv zH&wOA0RZT@TGx5wn&lpWjXy*BQlhYx_4rZua+x@G8AAUYd#38MKV5)2MkV9V()q|T)Faf?CI+_Zx+66 zuR8Pe>BpJbfh$dUL!cyU%}9Dq2Nl=*|NmX-8-G0Fb;N z$Bdbr>H|GDeEa^Tu)6Wa%?sSZL%h->M^B#Fk>=RYTy?hPvTn+jf+P85c`?3Ti_cPx2U7_T=k~-C~93}JD!L) zPYJEQdfnaqNK#0^4w5banOj^T~_2kVLYN$Jal9dAwVtr9;HT ztl_KsUQ8axg>0?qxR90A)qUkOJ|+=|NBsW%JB+ywG~1}|7=HE?571ioM}NNM_JpIb5|ezUR_lR_YOI7;?wdQ`M|{FDAmI1E7_;&j-NUJ z1ZMtT{Y^6W7@xTG`}eBO-l}Vt>hYWQe)u^4@Wl!e3EjTdaHF8w+fEM@k!{mvhTF~zl~FtkHT~KfMky-U&X5{j@d#7l8yq14Q)5IBirD@z~$N2~67-#%X_+M$Bx)60a zZFcm^g-4f|eT7;9S6d!mW<6+*yL0v8(`)Sc(GvmJT4!%?zPy{gbM4ae+c1Kl9oQ+F z>nl(++dS6UHa}FZA8<18di$$8HMZ%`#;#v}b5H15q`jf5n#e9NJP&zBo@aa|NXupTVNw?k%b&Y`JdmWeir|Z7e219mcc* z-SL%PRj2z=+_i+`oYN_$huQT-wz8jcEj`DWFNwA(k5jEgy{K3%BZg_|en6-aW;2ES(0 zh$01De==Jl&g1Hl+y{CpjIoO;JRmMx!lbmjA_H|0UU%y?$41?3(+ zajrJ+Jna^Au{Mjv6>ZAPn@3-(TIJ*n6D)}LGe&k*hzr*SIh-%TE_CR7xU^Jw`>%ny6Ni4`V}Qce%$ zHm~)p`%qxLL`$+F%123?v`f~$yZdwgy>&0PBD4LF_L~PMG4g$1C|LaPLeIU=8`he< zGB2Zx^-o83yt|GHZ|Q_8HLb58JH#@-xoFfs@WyXi4ps#Ozh3tA#N554Hdhc%WGN#y zNbw|Ir;b6QP%eQwvO)W}H>AKmqav2F(B_2ZR(7st@~H9x6`oi{Ch`y&P_AO980(;0 z_HBd@wcAA5b^*DTJ9`2LjjOO(hTX0iy@|D=6Nh(*>s3Ttv>wyzt4FnG2iAm35Ik{f zawKUoB#|G^C|{IiicF&?%DiY{^{r7&sicHp{V`9Xr3fdzPQ^T~4MxdUz-$>2=|`IW zriIsB?Zb!AOH@Du1(nESp^#cieG6&8->hp?zKki=PaVP9U2SG;RiAT(&*J=@P4-h2 z#JbS5tU9|D%6gC-xiE;AGZ>KYO3~;ZYq@we9JY~~)yt*s2afU-a-~O5k2)+=? zgk0t9$Ci8Qm#WDMul2uA$R<%=kZQtGquy1l7NmB)MU|1hY#x6<2L{6%os4OFb2JGZt~+ITkw26Z~?X+(9C zy~7^>Zo_G_)E=241HMMS@k=cK6P=UUK{6fg2kVx*J)|UR42>6dwlJg?DQyNhyp$b1 zB}k*KKDcFH&F|Lb2Qm_o4o9@)8?mTxSG`K|9J*de;_vMc{b%vNUfu8R0BYD12`rsY z$l*?1NRt}nPNk)MpBmB3umqi^-8JdnWhy%v7Y}AU);$?5@7PUK_A2Q48}i!frpG*T zNS{YfV3Gsj(;|=xCAKwBkF2`tbH|CnkX{=fE3j14DTiGX?Qf?iyqBM$8~Mn|tyhcT!JMF2^Uq4tRPYb2`_VKZ_rx#7|zOY^-7Do+?LG zW^yS;>r7I}E}O~U&LrBC=tkyjZj^o1=~lYf&a+o0yn}G*{x&YSmJ2Cm^d?D!XPE7b zD1D|f0=pMN6N!a#1g{aa10(=pTyO99E0IT*XbS01j~x9#Xo>2@4vP5yBa5Mf18lUL=eh7s$3y;+|!z}4cQkrPB1)jJJc@R3?ZoX|`_Jcyw19PAEb5>q^fj#6Sv z11*1zc-oxSgHlB_T>#G2+UcRabGYw#+^2&46AjRD338|INIjkbYpuHqZ{6flW2m75 zM9IQd_!rSFyj~T<{|%&HdGh|k6X@*5;cp4xvYMN)E~Q3+v6!aJvEy7tp?6@_R>dNACL*zn3F@#t;5ZJ9sj?F#cOF zD$6e8#O5r3dh^Mie4=CbA_$fXW$_G}CIDpbE`M4+&EuDc_R2`X%HkFZ*L9(UhZVgb zNJQ7;6|?{%!|4&YV)-0VM!KoG``aeN;pa=*`-cqlufB`^nY2aa44Y2$U5gPf#;!N%Xz^9p)8;I1fw& zw=h7c06Ia+-dm1^s2eMXR5@fIU?KZ&V|EiJrtk{tGB#$z9zo>y?1Gh@>U7SrArxLL ztH8t=cQIkw7h+Y(;Yq9|(#>+@> z$q3w#;`UfTrZ!KlW*HfJ7JO5XaFt!5c8s)Mm0Quqjif^fY_OaHZV@9zgO)iv|C_2- z$OllacAJ^0fOTXcXVplKYeP_5KHQ?4Kt7-SC{j??vr+#TR)rCl1)%Y?!dmKj6IPmq zyIivr>)LMzm1CV4yl#)e)609C=^6^EDV06pkqe*!8(0KzdSvjNloS63uWeXvfvY+v2RHjE%Y>kuU~RS4}CC-EpI*5$Q0af#tvtu1h}MT|{iILrDKnviPB zM97)*C%r1L&eG!sG$11iZA1Y%gO*vxkUP&SZ2HP8_kuVuq$rKQ#@LSbN2rNw@o7r; zmi6u(!uvUcze&fYl+&yw#KQ7Z)C9;&`d_dOGJ{%t|8df=6xjkW?8MQvHK%E981v?X zGZKK4hfyqCzfVZVzzA>ZZqqq@v&4_uk5_^rJiF51oe9`**56c#_)dtHRFzP%HlvnB zJcLuZ&}agBggU8B!gB_9oh^Xo7!81Z&DJ!fZ}7V7dr&PBC}DLiu$ztkdu08!9cSxF zikWQht)2U8BMVQ!L}MyM?nRXWGOXyP^*u74aF+R5*#IiK{TM26`Kao$*B4Jf4PWV! z=IBX-bST*LL$*l&UB%3Eja`a|jx|00f=Vz2jR5ptL##g2Eb{nf>KuAdNEo-%ub-|W zj_g)pa3E5}+2|G*>#chpd+t4tja{=Lg_I31dquvJ`?X1-m;!BOarXE)&pyGK0Ig-T zmY0Q!zoEM1uUNn9Alv^`E#=}abwwj7UPj%|K#acs^XM$TS%bIni@M0ceeL5fym+7% z&qnggt4;_p_xAw-6h&55o@@JVJxAc&a=aH_uWXflLGyy5#zMOtm0z?6;-osIdxnOpQ5j$d}qim@~UFq9oe4D1FIY<)x~MhJyGRv2LtBOZI= zu46unj^ah2>qFe|Pu=Wcd0iv+nu!FXBc9hKeov0BV+(;3BwQxtzptuh7#QOOUtTi- zHM6UyEB7L)Xs1ffIv?;Ax;gUvRBjPV@QJ1RHRx>0lujqsHrq>q-)=~sE+~r-x6{| zjc#{fftR(nUO86frsM;(eYvR80~IyfKL^A!kgUPApM^kihlR)km`_vq_AcF` zIl*!*3^6sCh+%?PkK^Qlt9~@Vi3ZdI2r3iWYvWagX*;20tSx~g=YSM((tpnS^5;8= z2}K632VYm;QcW#LXi1-a!&<&DXj*qmD5|o9!G(?R10U8(~=*wu6qcK?ZOrVHx+gJ zTGxoTjSVUr4@Kr8_nsRyFTS;-xS)L|E;?lt-;{EqDE!R=>)U?S5e68WgKd&H9~7g} zV(e%!9w%{@NKtn)015G~AOkoik~_u(a>dcVD;ku8!4KulKbjy>9;6@wMX4bCGs+k* zzjJIP8nVsxgyDZ#>2 zBODx8oM;kFX%S@8K2@|hz0;j{i8znT|N2@8a;Q($ZHkld-!e_dVK~_ZrSQ5H5VL@=Yv* zyE)Y)G!KiLvY_g3(popsH>I!%t8rjrv*?M+&56w?K%5wOvN#}H0Y#|!JvH5t!Y-bD z50-^@;C1_o@^0rnEGm6XIP>&QY2&`TyJyO`ZS%M|dgBj!LW|So5N2O_pVI*(fi6^%L>)XrP>0W+g|KVBe?EIOo3ALL~ey>t0k}fX% zJTT#Bcpqpb;UuVSHi$XXe?;mZDv%}A|Kw><)H+XtyQIc3SYq)4Q!$73dA-a0#e>(XHv0YacIXzVp9G^3Vb3jA@R!3SR;>iBXX+b{trIb}D47 zm>MwgOgg%VY7$TE*MHt9MM+#eGepQ+(c6_spge#%R*v%{;Z@c>^v+yJD!KdE^^%c< zsFkgsMFkOzVv7x@3%+34!k2`eNpGX>tvO%ac>gIFrRfG19%RcpIWv4G>ydZ{0CgOK_y^WFkd}wB z(Yh=N(LB6sQtZ~m2+vtzdg$62d*+RCbfpYUl(~aJr7d~@EBCI`H9B!>?r9?Ua{R1| zYM)B(u5SA^B4QMg~7Z>2ak$_!(NhB?Hp!UVZgB>^w1_F7CV5ZKM3NTEU~8*1HGEg z9n)L7gUqim3C+b@haVTi_nUr)G43G|3GJy79j|LXp~lfF=8Fvp+(1%^mqlvNNI9{i z*TSZfpcJE^z;3;T{FN@^w$om?WAz0@(SVZ1g7_xYc-Vt)jL5hwXm=uATJ^X4t#9|~Y5hXw8}sW4l*0axWiBF`iDq5PTRuet3mW6U{y9V)v5> zHg=$>;jj&bFK0s)mM9*uJ*Sr>*!!)=&c0#U&ulA_VlTy32B*Ah^4{UO#)13( z=@a%2)6@arZ(&jckJ{U#%hRg}gY&_ta#++3d4np1j_;#a@7;jj-e0J#Wy|* zafXUkW%o;;SXV229JAXwJ#>+KSl6T4$y$MO2&*^EEK1wi1sDDK{xpA*M^q;9y{y-X zCVYPs+J*Y#EXkh4gYK*lp2O6IP{F~GG1VNit1Cj~O)bXqkH}f};CdVJQn`u^i>5{} zl6v#d>NUxSO+Gm36-768&Y^8IYvxmQIBI>opz;mJFesn$HFbu!zF2bQY)1M4^3@AR z$E;4_S2v>6$gFINdf1`t0?qD18iY$5PUOdwJB#@$vev@pB4y+&+QI)RlbC(z#`3nC zKQ}A!hZY|OwC9;688gLD+5W8HALI?;VDz6C_F-P15wZ?KKVbpdyj;u!IoFd4Hv$~W zapO!82nS@`;vRJaB)zGIta>EcNML_P(Uv1k;1PBUb-|{NI|BHe+(fHO?m;^8s?LV6T}EM4$c8>FJ?{UIb5m>(+q%zbMxpcI^>%?Xos zXy^4JAKrlWr&19S85=?Q;a-ik++ukHJ^BCqJ#;_Ueg<_Xo#nFP$gti}H#)=!MFN4IPg03x=L__TeL_C=7g` z7hcn=1ZVN-Zedl90NVVx2#R9vP_3rEvJAn=X&_$^9Y}q~XtAu)KPgaO3~IEXOXR2& z#otjULo=?+S-us^ZVccm7w!!NB{UGhLasR}DX20^DEgi7U|ofT%m{3%!^*FTLn_|h zegCY-SN$3*K(V=H{M89);?)1t^-lLB&z(&79;V3lb~4g9{78+2cJ6`+?78O=BjpjybC^ZaULb6Fu+G{yne!FPRwPRBkVUV zRFHCLipOban=lbCu?8|f&7KIdR3V3y_fnZ4LAJbCp_+tn4cRJVGD9PV(fCSE)ZBnE zckmpH#1GQI^_&D9-w}cA$;K0D+k8!r(JHlqB*kh(cU4;w4Kine_gQ3wT!sH=D+K*L0oHG#VTer;M=dRs-%Yz?vKT0aocmMjF%ZaFK)T3E*3?nOu32Y3 zJE2}oIr}*42FQxTul!EF_%3?-%2m^~$IN_#oRjYqf3}JFF^tMtu0)s7P}q?WDShUaw-Ag$!vptq}@~sT2x|LLxt>0gy#2=x-Xu zS3%I+SM%3MfU<(`M5YsXE}wNJU^N7@g9T%EETjH2rd=}P@Pd?*!4 z-(A#?8ZR#rU&*Fy(sg>YSNn(Y>*5@NK4%&hMTwy8t03~f6~4mBze`V^x*fhC{hukk z>RyCO{+@ax%H7cX6HbE+5w_ES=@G_m?`v9E&2mVmaU;QkIj0~ph(_SuwLXm{$eK!I z3$6ZF6>kG8+OuHeLLqET{b%b@`!?MYb1F0d_+<5;K0CQzxjoH>@7sT#Z#BubIf8&w z2*6)=?0vJFzz)7AEw_jSKZ?3UEa1zKnB#0pK<6w-e(Cyv4W6nI{AG$|NJm>O3Y1nL%jvQ}HXrB}^f1U79_|0BVPl^X3VV>t%|-hTlf|9-F=XPW`##kO zhqiZ?wGV9AN<*DdNp7>2N* zP83>)17JjgbShEjrEl=AZgw?f9Q9qIrroOqjsg2-iaO-`X%6~b9~eq>U1)L_Jp&UY?HxYBvF zPq(4N1}+#%g+j>mtKr4h=|HRGZ`*&%fdoiXo5~6FDxn#wE)VphNX%a4hi$w;C@Iq6~l(z`6yE|+CT}Z zS>thQ9*Lv@%94;j1|zm?IL#PgIp?b$ z=RAB;*SD>o;WD|w^(Dh?oxGzM`!Cbvjymlz4XTLw0UTgDl;_N!^f~c}6c+3kjLeJHX1+uVi0%dQ8MTkC%r%l%#c>z$Q2w4(hmG_iOq@w=T@zp!; zo6qWQzI)Hkm@l&eh=f2y=WSvQ!tQ1xs)fL4I=A$sh)q0$Fv)YWC|Fa&5QbH)oqg!C z6d`lO|F}$~(of0yU)bZO0P(kut*k;sUVKxd)fVC*-G7$a&hd zsCH%VuqEyu`qPCoQCXz3!OJac;XFGj@>3GeX*%D+aHM+!Uq%E#WP9}$o(lEhel;r@ z>89&qz+iaO6!H=J6DsvAL7#kqFGj}DVtwjo2IGpK&crrpKAAO-K4V|uRp4N`Qh+o@ zlBWUN8l(+j1U>ngtTSmW9hKTMX)pla*>8?el_J93_D4{|CTE}hk>AJ_0OY_3=Puf#Otr1 zVuTMn_d*6Ms1Uz*Ax^RY}=9h-}%!p3$?v*7P1MFB2OzcO(fb1^m6Dup(}N23MGS6l!YMtDIL)cBRg<)?ojb58f z=LU ze<|1%q(xL-7z|T5fH@^MZ@|%x#(&>|mL;P%ccM_s2o?u%d6{a&ez{EDN@Z+CvEEj< zf-dxk;~&y*=eg$UphRwzqF>#iEl>+wAr&xMLfr(wWm{4JXo(rOH=lr2s^kxA4Pf= z20;G(VFJqp9qHuf(q|hx^URr33FXs=4s4@DffxW#6yLEf4-b`a#}hHQ8veHNf&T>} zs4L)=K~RhH?^U^uBE&v=ChpX7Dq&H_8WjffJ#qzLCx0tV%cdaDX!s3o{KJ`NnS@&z zIiZMivY;tDNjjV2?8AaJm%=&`)_`?-5*k0?*5(qck}gIItSz#sSE`jqoQ zD>lNnnZQ{7n}aYb+ls%p!y>*e6l}l)dM?H)t{ga8#EqcvSGSV0A~M&W{)_NnXP>$H zsNoq?_5;(Dfp8N~QaJem--hBI2A%)w`|ZObikZOQ@U-~gwnvRn?@Jg(al$c?RGR4# zb--x)b<^}cXHIS?nU9um=dSK>Va`}s?FzM$Z}`T;FGE5Wj4Ov@sa*GIT@5xEKAstS z@7ww&=97WAwL_6Av8ctbVQ%z%$D>)Av#-=0qe9Ql=YRdA6Zy66HG(6d6DTKrXy?nH zf!Fg2|K|lqk^z($!T4{h*?)Xn>HE<5J-fFTSezDHZA2JNACaNtZR|wS4g#t*wsCv1 zozC4{e75D_GbX8tij5NN$3CM-0XJcuhw3!njkT(IBt-tDO9RqT z%d$B7`Er#l(DQp;Mi^TLtPXt3R^0_<>ztI~Q}BfvzDPDUPID%I(R#|->A_9puyt>cl?e!DJ>lD|R`ZusJ^LHeteJd@u{jz&E zsdwsF+5~Sy9u`mWYoZQMR$$iiBPu!?StcGEPc;YgeVV6UrnPL?1m5v22z$|MiN9}e z@q~mT>F#KJ_}J#{j)AEwgqLy8yWdVVVGh6ZohLHYXQRhj$IwBCpNovC(ka<&*9K1+ zY`=W4_ok++6u!*b6^cN1hrXg|29?qydt#A|Bv*g6mSH@w3--p{KEmJy``CxqWi6hs ze-RSE6&0#qXpsoWZYuzYp&3sgEw)&M9^JHM@0O#{x`H*TnB5b()p7g$Mtrk!kUe7- zDhA>avv2im0^w(O{pu-AjqXIWGs0^bM64l^eKnQCJ2nbPZdq>>VF$tP^ElMgtQUPT!wVkqaM&+W_V!Z&#^LUY4{TSP^2?hWm* zeNl^OnChl<>|upZS|oh$>Xl5eQo+#d8l7OzaXt>8}-;OGj!lzNQOT3)%{o8$CoxEV#wb*s1 z0{sK;D(Y5G_M-NFgW%s<;E=2<<%_=(Z7;Ek5FF;7h|_8TiRbE~ zlVnI1=kiwvN5#Xj-sWecvipqJ%Bn2th0rKIj?-sfsT@w#@djhKfNshd3)EH^nOK6ZsHz5 ze#=Y3^MMRI$LD`u+?AirHPeRW)hssec~-iWFfiua|CFh- z>Se2bcqb5OZl8n_D7F0nyyQZdxr3(u#=*Jvqy=oXlSQbfH)-2qJKW-XFn{)n6lJY_ z$#T~Z1zgPAzU=S&~pQTO6}~k z`yj0}g~w3mE^NXX=oZNu*QZ_(qN)C{i`@)m&ztf|JnW9bcGSy|qG)B$CJ?e6x=6R> z1o=a+wXPv`u}{G=PJdSQ4LcdEW+!N(EzI?2B>=_+VmAY34Om>Cvz~+cLUJz+ro-TJ zU-6%pN*FHunrHmD_pc_4c572PZ}$aNZLI>!+na*Qiz{a!-Qo2yETrO}_h+;MLcm9{ zfsiYW3yIx{WD>$l`}ZN7U%$!Jh=)SkN=3usgkW3C;Ui`Rz19@U9i8v=Rhf^ZA*e}` zr>ixwXEgMVO@CYQ84J&F{|iO&k}ns!C8z>7CRz{a4j-_C4sB`)5 z(iFKvc2~p1NiGwcrmR2h&^|HVx-N&dQ7&YTA5+{Tx0`~|Tg&AI+3|2&y2JO3lR-3< zMmu(_?~kd?P+CEN&|vR5U7aR*=yQO+I+p1pR)0ABN|F0}HL$@)duzn?eY*_q885h} zFhP`%iI8g=IPJfsw+G7gx@zW)KhN-gUK6NLd<1Epmm8ASK$H=|uzV5bM2e<0wqpmu zwJr*NGhkRv%Qze~q3_krW`ZAu9!vf5$Q`12sGbId1dHrdoRklwxg%}IBN6$XZ*`CV ze5m-!i`Vcwy&W9Y9}%AikNl?&)^YYP$}7}B z%4G$24TsqI6(!~>lndM68y|^R3^7$%*H>s?V2F|xd*CldBYihTqN42D5GI1s(kFnH z;aj@P`OYDmhxbdo%k%L^sO~!bw7dY8JF%}ukJR5*Ql!}fhJN9$i2n&XGp8q0nLL^0 zK3>}iE6Ap^?TH;f+<8haGx|F{<{kmQ`h8+#;dtvMgp{yvT=7)S7+w6@JECvaEV1xQ zu2{+ERouBB4>hjeMbA;VlB`9?2dp^d#np6=fLD8DjusC3;Cd#MyLZe!Wu_>K-O-y) z(k0s{CP>YU{#K=}z2`~WNGic|r~(kZo78973c~JAFfnBDj*AnGVDS|surDJ`7%&kU zo5P?wQF}Jm=jPDUC(~SYv~AqSHGI8ncceX)Z<&?ftXRv{0GYGMa}fvSKTi){b#A@= zTYg}JNFQ4~-G0C_yM%q_j@=53@;C=qD z#KWH6Ba4DT(42-Gmha)MZhz@1J0%PR57O|sVcM&ITuFu!!bgM)a66;--F=_xe*E5* z%ujahv&KKN9}hia>m2&9vt)DU>1-tT!7j5!dz%6kHW#fX5M7bk5FQm^ z;^d3>MmPHCLkIGWI%z6V`Q91^@;2@mF8;81u{5l@`@sJE#$9^|7X2a7Hva@xxh8?( zazDit=32l?Vp&m3n5h6*c!{~f)ZUXJ9=_S5LFL*~5s+7aQO2FOThU%@pQjD(pO-ez zem&XswL<^#-NUcypid>ZMuNdjW*0L4lT19F@_amQ91Fp?ZnR8tZ-x*6zv?(e>D;Yh zU?zF0=Jh(stFS{&tvTn!JEx-~0>r1KBV#8FI7j8AwR=d%<-duc9A8Jfo^@jb z5U~&81gJOxhJidpY_DZtk9{DQT&HxYyD#H}#~Nvm#>+lA_E0p7t3m})HlT9>j^O2C zT%+Bxb@1H?=pA_Hyf?mbe9(u_n-hN(P(^GD10)|&4d4Im62*22o z(l8s_;0MH;ML&}HTv7?b7Rv--+U4)S{y#|Y_$Id=hkL4j)d~*&@)lRI~ z9AxXG>sK(NfRmb(5=!kU4iVuGeJ7ouD>% zaKOWY2x+tW5Hi%aBbmDXB`rsfXf^pZXbO?G8J*MPbA`PTC_jY*>6^zS7n2 zj#7=1{R6FX$S|t6cT=3Bu!cgR*|PwLKQO<7uggS0Y-ml6r%}I4 zJVHk=BIoJwzeGz1U`pbH9Cr(;JDSsrKe0gHG*AEEW7VVZ$A;&jsS#Nxy?=)%H5=e! zS5SMMMj~2O%IzqXvW5+#nwTm>yzJ#th}w-$tD4#F}pPxC9JNP+Q9 zKzML?&Os)ke}wj=NA|DWDpPzLMjl-!`^khgC*0~sV#$o^=}pNb@2l>j84*8F9NF&V z6>zc*;j#=l)xe0H7;_Rtm+zD3xI@6%H8s5mrzE8aQ^%trI3@Yw&y9c9k>!HVD)qCX z8w%6^r~(1^}QQ)q5d56Yju^-RQ@gdX{-9!wL> zXy;bXXJoH_cjN+DYe|^&Smy;Bxx@I7KQ zwy7|ENh$Jlb0u~nB5yk4J7BpD;}Rv-4CC{Xd(@lxO_<4cMd zlc9kZ!QI!z!!?YjGWsgRueSk!lTwPDdqz+}=)7pXRmVjx(C(-p$K1TU#JIZ7 zXLnzio6B1GwyZXEH6<>cIR8d3XhMZ`MLFo+=imn?rP$X{m!-RL1`Q)a^PUKtKET6G z!v}rQ zomO#lFtV2~ES2KmzrhTFM;M-S;mWng? zUc0%AvLfG}e)K|-HPt%I?Xfu>Y*a#p$p6b*xe(Qr?v&EH84x{ z^5QaEHJ7Jf|NEg*eBpkUSBFXvad*F_&c(ML%XN*dggjLR=JMm=zlOzyFT`;=z5YMgtT;w%cw+QGQMaQLGd5;EGkdB2SqQ)6A*|3;HSzdT-{ ziS*D+7g$h5U8ML*lkuzjyc_~Z6ThrG52hbEPtp1zr+Yd1a~49wV281QhcsV3;*g;Z zh{cG7N2cb}i1K)oKiQ-GL5np?$j(zq?g@{_sd6KS%?m*93VobbUtRsAotPhim-p}a z{NsM<%JCs}H?bj7YQ_waX#jn`_O5O5bftS*8SoKNJj1BVS{Y(Y=N1J!+f|P*S>ED5 z)E?aAg#8w9p|MEH=|BFr!VmjxUg_J|i4QuDWIFB^ttySaFyfu zcrikS?C-s}Xx>J;GDbRkMusy%UIf-e*#gO*{9`V^Xyx-VxErsnu2HYGZr{!PH=j4& zt2nUvvd_ZX`v<)wKB@jqSG$<$1h?1pCo+zwvT=2vv%?u(7Jhc`P+B+q(oM<~~ zY4kZPE%N9R_N!>I+;0}}J$ravhUc!^F^b)zbuwh+WV*?E0ATf4F5)9qrWJ}VCEiAm z!1FtTxVGi@WTON=$)4299nMiaJ7c;H`Sq4l)~owWvi!1NAAT#Vo_Xr)h*4Vhafgt( zKW}bmI`MQEbLO2UueWaVEKNNsU3-QAEPuyl20>1sEZZc$gu8|rXHNHE2!}V-+DD%Y zj3?MBS1lQIaQ$B0w*)+u=#JDGfJ*QAdGe^zVlP4rBkWe|$UC2C8EEfQnvTHl-0S6T z7}&@BM-j`Q-!Hhp7O(%S;LIPHe*8H8e(yA!&1^PfcyB4>8gnK!a#wOLqS_pxq@hru z&7CV}DAk7KlMY4Ysy0VSK1J6@sLxPRRO%zS%D3-7@cQ}ne7v5Im*re)`Oe#GdG?lo zlorL&NdnH;#;G6I*A2~leATcj>gab_JP_KgIWnIS*y1wKdMmYInE?G1bYV5$r<{H8tBv0QTk&SW9hXMueTe~n0*3an@3#Qvgj8jw3-e<2 z8dgvb4x~}KQ*+y`1NXW=J`7j`QsT@pqh=XA8~jUqMRt~~I@9^%9ga5FY4IWz69hN( z1ZNs!U370Rc*|IxsTwWzYqMo~*#w;#&N{NK%bbJdl_cjW4!t5q$J$o?`q7&X-NVw8 zBNd#=eYWn=$Hmh}U1mF?Pc27{M4ms?)ao;PC*!*m_5Jt;}oY#BaYXA{8=U1erBlY1kdF5XFKdHRq3{h9FnJAP+|tln$UxH~w$ zC@$xH2uyr#@xCOlGLcCuaC%ojjVRZ|>JnWpEV4H?mlhO?43)Q-y_1CA z{V_~<&^Xgc3`#Zh5>YCodPAJV=Sw{g@rH5+LVmUTs!*vAt~l@j(@l4y+lQYJ;#f`N zR-xtY%lrDT@cUZdweyPnHnna2$7Ob9GR|Ny&UQ-ME(?wTbU+1)&H_S8N<-xXf(7MZ z$CD&|ZgZknFj9RizLzC*QC38*m%6QATbrKizt+9Xp$4^m+W~K(tHePu7evUvG|R?$ zEgYPRU+0ucxG2CiC)Cwmd>*X>o)d4Uwg*d20p1d9jVCD}kcGLbBW@ zb&!8r-NG!HC;0g#s}0BeINK2N1S5;B=q@6mu|Yk#G=o=-1M)2yg&3y9wbiWWVa3`I zJTIV{_*A_17+%;|9i9c(KjfC($`5(nq!AZV>JX5YEHM;M)k=HZ+z165c^HzC@_~rj zfl?U%SsEt|C2A<^N2yA-af+GExlqiQ9_ zw6c(3iZyK>bTmIG83H^%TlCS*iX^xrqcN+e6g$P7N&+rB1V$bj%P3UQ5_Bn<1?T)# zH(6WSiPG5hR}Tp62fNbU>Zc@z)g3;U>yhy{WT4eHfsm|lyF{g9UMS~mBo%|<<-3zu zAx6k?S9niuqh21^9?D{!B#`|)(I}9FbLblPc3-rR^PdyC|I_9u?w)uG2 zopWvW)J-Lt(IQ7v&2Z7_e?Qw5)?`$*8lNlFBtNj8ELd}F5Ju6HR28S~UJpt^bb)ns znSFNAMY}KADj(Xdv-W=iHR^=Iyz1I_!n}js2l1)sn`-YwcFR5h$hs-j$>r$uO-k&o zAh|IOzx%KkDl|J?hC(*juNEi}(qykPsnex?{j8%zGnF-|*1^5&qP_e)*?$^XPw3T# zmUL|K;8>~da1An{lqM1)LOsRzcP;^P5k9!M*2a9FdV)wbyNM)1$F{;#Stp0*+pF71 zO-kcY{_c9aj7|B9p9eIZv0Ixt-L8q6jqh+lh0=_BS;uZDqt-FA-=*oGPBTpI;@0|S zkybV&Ub7yTJHD6d2Y;R@@tO8#c4E<$)xP>o3zD8Kw+9({*zaN7V&uOoj1hc`Fx3;6 zEhdrsd*7*3gNw&2^b*gjY}+7d66Hm20{cE*>Y=j}B&JFyK61g zKdGDRW2ifgl45(cVmlzQDb3#V)xFZsW6B<$nMeUo=s6=k43|4$f@AXz@W#|W)5@R6 z+h^JuLJ9_AhDPYXB}ivNi`ht^_X|CRq~Phx1wfOkMuE`2{s0UjHT75i5i8CGx3Nsq}> z1^*-jE3@BD9-+VjGSuIk^B~z&Fsjh?p_BnvOX4AZnRc1F4~Wo!T)i=(0ClGcFl&*h zM6U+tJnQam{#wh*P!=Nq=3lCHhL1qkK+bxUAV>3y91))gC+Q4iJ2!H&4S6t2^Vxhe zR|u9f@K_Y8?9}03#6w8OG3s-WtedZ$_%4X@YKrFBI3+mMuE1u`Z_71j3(2|utCa7` zJ!99MuX@+@eG=u6XXG&3As0rmShzf@gx#R!O8#?ORjUbAEK_VGIINW2|m^-d1s3rRe5&N)|A)fX}lM7t}1Aq0e$3r z*j=-(zncd{lQZMsu81uOlW@4nQQd@fQM>$asayyN#n7X32((53uU%2BxypE;@qIAc zvRL(X1Kk;U}X*aUxIk?<1kQn`wQwjyYq!SupB^47*1vf)$Ej zt~j1b=u{7}BeWzE(FxvEcnW_o#xs302GTb5k+}nbF*?&K{@JPVnXugLdzgyBa^!`0 zJrU}Kyp61yo=-bCara&eh|qHwP2YG&f85E-`QGEb#aG^)cBZ|MP=3^FkE4?2%Fzwm zIamQJbx&n9oY!cNu7@xIL1`s-FOseul>YHQZR9xZ&^|IOMrp4PpBfGbm2MBy*B3IB z%hj6kCz`Oyy-J}_; z8R(_0LI$-{oHt4H2TQUY$OSQZYg#0#%Jl+t0WZ}yJCf=$d%1!uoOCnH&^tTRWgM-X zubRzQ(NF_!G4iuM2k>CIlcK)=E)VDazJ%ZE>FY`hj64CblQOD<7d=>6HoZIV&7J!> zaB|OFX_1(&FXrTz5!seei!U$fZ855DR08Ps8gE*=&b-Jg)yIu1wEjWAjX>IN9VG0d zLz9x$EZ{vG4E!P@YCohN#00JKMl7E+K*j=5>nSlfar&qU&2gK7;-YchkF`Z7&Tslp zwR5VdeC1taNj7z*{;QDS1S{r%$kIO)pCh$SgypSQQz@c*ESrxCPF^#Sqx=P3U5Au2 zG@`ncEukKQ`(InMzKFqNU0V=_0uU+Rean(7L>lj35m5P<&D^i8aeJK3Sy?7cO*d=m z{hR#t#Aarz9JOhF!7NO{lAJfSqPE9K0fUpPmi)Op36u&nfHe7^O?+)PbTZPBuigk? zqj(xaPf-4H)qY@Zh>tVmp_u?$O$ey-(9ZG&UxUSla$Z_5cH(5p|O{^e%u2dTun?#90PAl z0(nBUzKelcVnVZ!TF3gb)b)7MgQh12KSA(NfPm*AD!#%@fcLCM5`vGIg_iaiKkt9s zVV0kB?Nl@_!{mukZvThpdprq03t!B0P}&TzlL3q8q4AuG6^NVz5cbrOQVYTDkpRoR zLuaa*EGMJHk}HC&j)MpU7TqZ&4{?Z02=}P*>pFQ)ynJLf8iD6w92iR}hF+%G5W^)ZX5O-5HZlfgF>gjW=B)0|Py-Ya@k!gXHe zUns7p8r&QDJWWFgv3rC>H5mraqjd>URUGnnF@6@pF^yoT7<9+q)xOg(%bS{-$_t$g z`lyJwOX~3nR2K;U%tzN3;atSzM=bP*Z}1PqrT)iS|FUxGuh+U4ny6q8d9OD`73<~3 zR=G-{*ASx%!a2$``(*GJ666Y`>@)_9GU%RL$?9SdFEl8-VbC=O%nE6_LX@Wr5j)0k zg}^8QV)hHz)wo~?th>WP76VJ0gj%8*ILEVBaC7hK)H?00?%K2l6GR$6&)byhBM4U3 z&M{@sM5u~lRILi&%IjM%B;py!2%gzFG26BY?+xMH&Hg+uQi_!+X)&quQusZ9R(S}v zRDd&rump&H8o&n+5q84A7-q?;-w58D|hLeUE9Q>S4lO^Ab2nlFDLerCHMt1 z>!%HyO}0}jNfl?_ zq{IE~fsKIn9wEwCf?dT+HJTd1ch5CDA>@kK$_H8!e|>_Wm{Bz-O9;p3RM_uo9Ph{QUzj!+dDXMY-?Vy3Ez=>#ISuL4ZH;DY3|exD4vnf z9L?z80ju{V`kH1q`8Q(;fs)H1JAy8ev0h1sC;P7=1`pu#pR*o+fESm#5mdbx)o<6$ z5p_s-xzLOxL}`sVL<)(HfRB$D>kBIS%6#51ob6v?&VUAdvWMM&+bfHmYn~Fm#9_Rp z9!?CGZ{8-7r!Hwx)+Y|zT#T^!_kbQr)t}^t(ls|Dah!h%Q7W7OJ2u$p<9?2#N{=(z@ZDuc3iPq?@Vn(V29dchJL1W`$1o;w&E-<`&W2vCN0)5YFig`__f)6B9l$t}7Lq~!z z9HJ#<_oE}$B_;L(NCi6deLWWAK?(EWrf4y-Q8FqEixKNHw^@dHap8&Xrndo14%lR# z+eA;@cYq5|nP;SOBVsHW`?+DcmSJJ>7M@(+P1t=FkY|pHb~8Cpx6J#akN5HqFFO)< z4C1q;1Xnil3mbP@?6)SKA8FiTb!c47zB+;dN`Z25FjO^3(S};-} zCyy5r29Nb>qU^O}!y|;7!mRkJw-r_(xSZ=(F8BY}oa}3HkPsiJT^2p|%{j)`BAi|UFuV%Tm@mM{;4=OME*8-9F!Wz-WeNy+RruQcv$>#Q*j-~>a6k3I%f4@P@2N4 z6(XK}53)M&u_Oge@y1ZJFt_7hTSix!B}|YHP8@cg;6^dZg7c{^CuW?FlC?`ptaD4j zw`Irp>E<_~BN!Mwg&$6J@Nq1MIAD|fVT=J28~iTx1Q@a^y%TGKP2ouD=;-u-M253J z+;}=QMD5I(laB6plCjLRA|ONQq24rus5iGOj2hfy86Q{foWRCSk-P)_;(u8MFW$)+ zo8Lri3EFE)c|WMMSi&k}b1)G3*@I>Jhh*)4pqoFB884V`TqxkKaWM=oPz(-h;z7O@ zLjPB>vHscb7fy{WB%j5QVHXciFQk3-H-F|2?J)2wTHrA(koyi>O#?gHZ=EP>iKm`M z#W$U-@jn<|rq$k(yZD_OQ^u>Xsz}#|`!_BR3^Cn@vepK(6;kv0H0Gp#KF%Tbj@(B; zi`YU<{%KtfKUy)NR&b=UK6Ekdr@vKsY9jjQ6?wZn1QRV7{G0}a)qvglR{^t!KGLvjp^KT+5{$K z3HM*uFWl~UswhBgTOLxlSdlA(=;ihEi)@u2G~+|gt$xCT&zvW2D_G9g9R111E(CsK z?>MBg<6x}T9krwP)#}2e+Vf4%mcE_;b~M9&`lePV6<59g=BUJL`JL?`5p4dk2yA@c%Av*G{ zUe3p#wT4fgE)6_$Envwba7ig}>B?9@^y(77?!w?+OA1;bhwHQ;ZLBKM4_YZYrZhFJ#0W%YSBl;nX6AcM;05Z@@5bTz9!-(vT)8(dq+z9~~=xfB0N$ z3tj;#B_u}ki>yvWZH~FQ`J1|K7%%7t+uDkYI`0*tY9CSpfzM(I#N`S&=f>xSR{a{a zHY?_BVXVQ=^7}iF^K09@dMeKDY9rbJ`)O?#+S%Q18(PPZoR^wG%g*^b4{l*#1RQR_ zQv6-jJ8|UR+2)q4lAv!RE>03WY(%?Qj6WX}k{=j?5jQIRKx!;EZ?%n~9B&J6F*WB@ zn{MG6CozVGy8eig4NDSYb=K+|>q@JA!s^$0UNTLn_=^7Na|T=yX(;f0jI>04<>#&& z4g#%ZuvdkyyKLWE6c}=%1SpmQK>-9?TP8XDNYC+xQ%CFSHUL41mgl8mYe$Yj|0r<( ziMc!qHPSn3)C;`23OXJ^{)kgMC?WnGdL^Ph$eaAaruV73%X`~WiAi+WU`NYQ+20LX zR;PiKrbDC^4-$Qllq9p6&)Ed1Lsf)xbY{Os_e3YOA*k%UPWQ*L2 z1xhPz_vRm@fug|8t5`b_w^L1DlQ~)u;g_6lFcRw>n4c&73)u;^ZR~iwQgF-~=+G3u zRI3`=dGqPW1(U2dfx9DoiICy8f2Yt6|0xM%cECubz!F+F3v5 z@SU9;Jn*~vr52N8`|85t8*N*!I2j^(4IQU7?x#I|!Bn=)m|fOF&jN(vJs&HzhHc_s zvjG%}KQ1ZxcBq@GqXCZsBW-PO{?n3TzVaqv|J$*Z@9^P#)2#of$Bw9mGjBrKVV|g+ z-=3`^B`t5mu+6hYb{`+@owu=kOsd}uJ3zTYyYj!Xf$V1b%$qlF-n^aptnu7sHW&?)eB?2VMu+b& zm7Te_LEoY{+Z@L4uHtZbP(T$m;f6K2g+n=y;wz_Vvf+s1I4=E&v(Y{DwbWpn|L$8li`=(<|Q zTDsHp^rq4s`3zUqRvzDluA^lz0kY&fIGQe>w?LX9xXdOv3j}Va+S*&UZq?eVr^Vwt zY3rDnm}uj=+Pb>aAjUNJ?OXw4+cd8GXHXtl5%#K%WL$SGvQAn|o~t%{m9~x+t_=mL z(aECbL38+QHvyZ+r8De#9s;uo9v*B5Q%9zwfeBL=pJr(9Xf#bn$H90SgTZ7>W9jHP z>M(Wn84Nw<1U0&>-3&KN%MX_b1R{%cbw#Dp=`+B?($aJukLlsc;tDM0&6H5gfyabm z-JE#>p1U*8%@nscbkH}HRKVa@DlkL)z09Cl+K7Z*+68Tu_yJjgz}g+1hN|<&f2cw} ziN+MUC~|!g1wJV<#a$G+K8XUK6q({Kid>&WflrD|aTi6dPolslMW(omBG)HT;FBU# z+(nV=lPK^>k^isU1@;}8Rfxp}Q_xnh`C!OuBwtCIk@{ha;7-HjWOve{^f?*Um%Ngf zS$i=ul|moVsQ}l}WXxgR-SYLMTa~=Rg(gX*M!Lbuh0;urSh3VPtX^_teS~D3MVPju zBZP3^sw7P%@wxmT&ki45GV3*PmBle2eWrE#ka;$P8^hc%jQHS3z61q-Fo^gqVI*Zx z))>%Lk#xzCuHNKTdLjK)NC%<_P)BaI+*}V12X3e#N?=9fI=EZgZ(@Q= znr=B$paU+ly0$zwI)}$~0yp_t%5oHRbTqSNA9Yt8~+Nu zA&}Os97Qq=y!*pfnRHmp>yo#!6QAed*3CSA+z)#gJEWY3a(O1g6yGQS3?_|#7@c3Pbt0BpM?!t}$NP=1MxQN!O0-l?- zhrpfHm2uQKz)0`;_O|BNHS67)>gj29hqsxN2l5IZD-MqZshr z3*Qy+6YhK9t3DnZiqVJ^A_wcYc!9+Nj3!3|*$GmVsKk2DLALab=9ZWoQHAv-U6=!; zf)wf4H&|~K6%|#L-m0p-HF~M_(io)PySMtFp#ugC8Zcm}MsM;Xy-6HBue3hBdiCks zr(fT`{RZ~!+jk(k^c^TkqVX{q5CNEm3N&Z0JZ&5%r$Lj~pb?ocW>ttF+AOH0B8~h& zh0#YI8mFMBq^zQ<){E9N5atYdSztemra+UIQ;<_sR#H)v@2v-c8uAKb`|Bvq`GPTE z+~%)!l?MKB`QhBp#t&Nl+Fnnezc1EYS@Wb#O>QmI-C*#QNBcjY_oJ=D{5MwxhC||3 z$JXeLx6kG8J85n+i0Q6h ztEq%4p!~VPn>eV%)gcb^R~QOdc^y^w^%_j*tOAjS^_C~g)WBw8LfexTnv=$#v{-C0 z{^atL7UO@q*3*N)h!|4N$Cj#roH@z1+4VQbCwN{Q7T@UY#dT;7M1byw&Q6N=AGAm(D3f=@r-j*4m|OH`*q&D z8SX2NZAqWxv$3d>IrzIm@k2f3OM)t|gv~=UwyrpeHJqaUT4&1y|6 zsoljmvMiLIH8hqzk|*DAcF)tFdVBXTv30ou%{NoC7#|cczA@Qy&$z|wHAC_}vb|Q= z{AY`mX4H_EcWeAP{M-d*KBh+wcr#`t_@=CS_N!8J$HW)_ZpKh|8co`(#p(} zNemrf{PE(1;uRi_A!>J?`aLyxx2I%`OBJ(bbZcE{ga51zktbp&?K-@EoptiOwTah! zv-T%GKVuVqCH-KTynETx@VmP_hU6D8nR)(+8LqnwGwssGl+LVfxO-*kx!#roUlFm; z3tv2}^g8e^XZ(#NW6B3Ry6CT(phf|z7JpR)V$KBoWM*xzPs4`Ms%i4^;nsGQ9^}h`ikbZtu}1+hDW2y zUOqLwA?jt8oja@ia0*@1c)!B{FYdGRgSR#ZmK-guez$A&QvCwackMQ7=O?DEW&Pl~ z`+n4`%a7Y9#9RL$#!crNH=h=r)s1*OjCC}KWhqQwZ}sSf*2|kI(N?cw)-<*e*jX<( zGxOWoKMHrZbM8)j8L8#9ME#3v`a9}3tP=*9Otbb=7fe*Ake8_y@LdM&u6h zBY|HvqagAZgv{G z6bWqO4mwx9+;M(ona5hL$^BofON@3TnjPOcrrbdI(*K@|sLXp-{(viv$=@gCI<5+z z_^3RsZ1w2#OpnOjDPP0Vwu_VRwS=ew`mb~tj~?-^#a{pUN2q+!R_ zDw-3RGQTR3Yp-$8V!^DdH=8$J`{6MWCtUGXw6mP+MPQH0Huo8HL^mVL{!Ll!!)NKO z@#WshyHDO-efR|LdV5*rkTar9UZ+Hys8>1%!+UM^8njn+=M?oTNnC-e>+b7Y%`Vn> zi}%M1weEe*r=8IMHe}qaQ-1N;erJ0Jv|7!uuKO;$%&uRf|H1V$W2P%bMhlzv{Omo( z%EGHwr zfN)>rqe$hM?sv+3&nRh3-(2RJyt2uS+rHe13jgqclNqW`*Qliq6;IVE2gI$ z@fcWOTgLNxnoz6mm1A;ko5}G;Uq{hOW@^mCttA`%bM|Of?}AAxhM%-d82e`si5qG|eam(|@7Pm8~ZCHnSG- zz|gzbg{E&$&8m23(&zb$hxbw&vNB#3y9hV!XO&4Du<>|dVKO&h_y zoAh9riFZQq%U8>9tV+xFsW&_FZAr7f!!EmWAEDn5C)Udkx$dKR&v3Xnw6#%u{9)P5 zv)WtqHa^a}-{9i1WkS-7(N~YyRc>nCdZ!{hY})f1@vYa7Unj7ucgpVWo}S8_d>y30 zv=!@Z5^kQ^+kd3Z423>@FWm2|-RkUf^FjHLgwO5PCuSc^vY*bqj~EW2)^pM30x6Dt?4NO#?EcFS{7)h-V|-+Lo6+Sa=4Dt}j(GD0||EWX@D z@u}0Ab;W%~=CUduB+oj(vFMdpbyaH$zpVUO>cZGz+eYc0^VxNJ7uL$#wl%eBr@zvU zvp=*wQO(UeeS>Ku=B}I7aEfeE=4jT)7sZvd{UUX!Mgq;>v4=|%vGV*F^}UO&$y#2*DpD$T2+>PKf7$|T^-XG zi@pqc^wk{3m|}zUWhVT@jX7^Cm@jU6mW-NmKW7au{N3&;1}<(7?`dUD>n+rKJo9{` z_p!97S5bS?_B^(0)$~1fz|o^3@RqCc+L8LborU$d3 zWIKrr{15CucEIkYxxI(`yZf6(#lAGB3jrg6q#-~0VlOik{ySC7&zJCvC9!@ueD6wwYatN%F|R2VVl_$|ApBEw&{MW+BVvo*%5Cv*O^C)j zvBWy@!l4C&Hz;nqT5*0(mCxjxCe`XY^LG;1qNe9QJJ%u)Zzc_W` z@R3J;Wl<)YNvoPnAB~K*PJ9}Y7F@aW)!7}Fd5IOtBHOp6>bGWnHmpLscW7Gj4xYAf zb>mUa9nPKTn{Cr4jHvL|6Yi-QM9&c|ixS;DcJZRC!HWT7G`xl$>#bC=`G+#Q)oIE0 zxzm##B-}W5(WSk$^lpPn!>OX_=V$FXRCp%x!PT3*gzCFz1Qpyfj$^kB9&w?4hyU6I z$*b0ttKXU?-1s74PyGqYjS1OzJ#bw=vwK4yyp~V!X*D~(>uG#@b@6JK?6N)62~5Se zRearJvFWsDqc0e)IAgchW84kpycY@Kx5ekRh3B10M>G~EmuIiYI=!%d%yl29M6F+T z97xq?9obw#OmX=dv#7Vla+WcKB-`Z0E+vmRVAClZ9VXToof zzgc$e6K_N+xt1PFE+k?7j8@yQddB8p4q&3P$5x!GAcWNJhmld)kPO-t8naNf&%rkozOc$CZ35(-T;0=`$+mORjkIt~7svHYaXnL9m#(94 zs$*!Xiwu*P{3V*CJc7WmOLDS&X}?^O@Ayqe5#ggmlb6;FtbCpIrw#6`KW%i^`h)!e z*)C9PKbPyso6HMcy44x=iTWkvt&---b3=9hrpLqb#L{W6V+@Fz@!rK+TFFU~gf4;lV)WeR5y*Tn=6KfP$1= z3;En`?&S{M!uv>Sv5duM!iL^1Pa70DJa_l)T|D~pSq>gdwAZ+2mHRJ$F9g+kjsq!$ zd+h+Tw}Yfr-72rT1_fAf9no_gB9@L&_V0~suPgoA3>+ufP%D3}j9u{$2^Ab-r9!?*30wOVJ^5RCFvX1mYd z#$a}|7NzN$w;D;krKm5u<@DzeZ>WIJ;JUjp_$)4SyOc3q;R%_HQ4rS+Bx|^c?JnRs z!G3r<7WrtR>jShur>-MDP}h$bTk{;(ifiW=`c%sV(1=$1RVh*T0ID^55a0PoOuEf2ajra>m1{w-ya_o^n zP(aN?ZZ_9(n>3tsyKr4(l0;IbyPKmloP1KvVRBIZD)1#gC=bVNd^d0)8ut9?g8*rR zqUjLOgj7Hvsy+P1majmRvVo^e@IZAC%0)scAP$DbpbLCHnoe#Ag%q7loC;7sDM*aKtWy>wB7Lv8J-EQNI0kdGVSu*~UW+}VL{Aau5kY2OhmPvxpE(+AA zh*jWYyKO1zd8j}7Euc#u4)?+qVAj}jjE>pBf^9iwfmvY-Q5-T>_nEfqCIM^_e+Sor z=RtCVBtC|%p+fto*O(xhj~&OYq5vBfbGa;f*u2hm~guG0yf`WuoRkP!F2$QgpO;0r;UKY z7j*TQ&jrPyOE?@4W6fnb^7t%i0^~8r5u~TYJqIN2qU~Fivzw2FD$UFxP|6aA!C%_-vWa5;oVJ=i*__ zcR<7gMuLfGJL(W~o~s+r9XusTNfwdt$sC7G(2eLsn5VJs3F5*nWrkx&L1R@%UOIUm^8fX$>vj7$vq~EWL28S=EGtT zO&Kt$*t)}MR7n$LT}bZULIMd%=%pa?JQz--__G5^XYTAFk!P@wLFuJ_UFaqCv12>% zwo3JPlwQ}MBeFFgma5zyVOG4kd=|q+)_zzkaL6@*RHBh07|L78;CKL0Wa1IYX&tD( z>~2W9WzrFmmggc_Tm1KYx=j@l!HjCKfWwe6p(HEPLrQ5f0-AAUb%w2GsF$JT0%wwU zIz_Z3%lG7T=KzpauhWAX5!8tI$B&4QoMd#RlMGr9Ae)zTu#ir7Yp!hk**NpIB0rfM z{U+xNQV&M1F47+qLh$$q5%U4j&?T#nlv5wbgcP$#mM$W#KDIoRE0Qnn()vqe2CQG$ z5S8JMbm|rEtOYP%Nu)ce(2~MNmO^_u?B-{Itx-xKsT~8!X&YyTTgSq|4veNS<#kR3 zFbkPGvpEi6tLo4p$rLip7iJaMdX0=CXhK7^mT9XWmDl^p(O&RrI>uUh208|Y9f~%Z zh$Pc8sq>?i3zGFXU7s#hJN--S$SN(-JU*$tGF_}2?~t6>%}1gS ztfiBh8hJs~MTxs8aGk0bqChuBmnnec$dzo$m-d#dr^qrbk;b)_uCGHk!085hFho!> zGF3?$N|sEHD?Q+}j~uWvg+g}!9Tf{nb6^z?H77Yj)}#;X4^aIcdW1xImUZHDl^4;5{~Sm^?xMmb?d0Eyl0?KHvsn2qwDL_^-bvdy8nv_b&z4HrMzBkP zl!a)ld@LJwW6Tdaw9R=u7q(0;cJ7IguKv)JB;(>`u%Hx>tSk}AvN6$xySq(Dz{y;9 zuvxj132_)oGJ6SXLibP|spybdQo4ugN<*b3_8e=-nAfdwQdOSi&hvohe)Bqwgi_-V zJgS5oB~7#fj3d%i`2L=jB^Vow_wHcCcL6j0A~5UoF^5TXZ7UvWup?8A#nw&2rozS+ zQ*1gMA6Sp=!miK<(TCAT(ebhJV^wh)E{7}Ps(3HF53Y`D;DhivxH&!_Ux-`aOng6n z06&Bu$Is&D@bmZu{4#zOzmDI;Z{vY@K3<3y<5jp2Z^Ya1c3gyu2^yhDs1m)2zQk~1 z1Tls%Bi54@LZS-UJJ(Ib)?z!ctJqEYQ2Iz*1y{p+<9+ddcz=8#Ax|g}Dg>RFPOK#g zA=wfZ%MGQ1`f7qxW;#RpK#Ne#rIyl9q?8R%%n=iGrxYT|2Z(_h-6n0?e`#2c)(nJp zKr23_4T$F~d7IcvJY3mb``-dRKSc}iU*`iu%o19(3AkYi@PRAbZD1Fa0MqG4p5Ks> z?(db6-tU!>zBD6pq&l;#&_hB_=gJqUDYi229+pf9>h9B(+8tD$2NZOK5#<4g9}%a# zZ%#+~Q0DZ1o;e+{R3|5WkU6Yixbb12F)$9WMrY(M1{YGv1?9OzUxkGVnzTR3;3zS= z$@F?%G{bgLJ3ijn_`W@~LpcU@{`a#)k}Hc(vqVaoNEsqY)d}ejU3Caxtv|*1DD8y* zVtXVXVSb3wJ9Qm2Zb)wbkn*w;#3?8zFk-myod%DUc_3JkvSLF*C?bK45|g?dVk1Ch zbY_9kToz!-0uwh=w$AJvRcJ_{CvvP#QwESwPhZCv0_M1*T~$b}gWa=Ws7Jttl82hQ zxRC*vror4UF`YmfBYi-IggCI12CcMhd9s0l!VL8d!T8)^bB70$VE#as3@zNy$QV{h z9YMCvY^Dp?Ho%OprGx9?U~*YxzIchmrcNeeaAek{l^^o$q-YPd#ug@aSD>RiJSS&i zTj7a0kCZ`NczSLFDuC@DMNM4;pkFs?8XAL1qLZ3>xS=6dz(Sn?U23C;9u1>F`wyp) zdVe4VXd@gThqMqQWFG3W1mBCnAM9xPo$q7Tc&)FUPY``)=FFO+O%S&hW>_pWBM7;9 z-^^!ECy2pwUz<0W5QK^Ovw6Rm62ueZjVAh91W`2ojM;G=g4jQ+Xm*nUK}5`mn7K(0 z($5?^`!Vdp8NI-9;Vnq-HFt)&r!hesGh@tL4B4w!qv_`)1}lPJ>( zI-dA!<6M(kZBKlI(NGgpEl+%v@d1+ox}Nw9BYBf0;J+RJO4oFfCq7l{oOTr43$$+H z9&o4WZO|X06@O!tj-&4DsRXfpbkvyq5d<-4dhv9gi6<_h*Wcw%5VTEV=h=LMC{^qy zuRDq$s+Cg|rj8|u`3f<#l|w!8oYAXB_)hO^Pr*Q@#$KRblA?-yz(`NrUhx+><_J&x z@L=@;bwEE^``=E_HWt`;;*|=E<+cwe2y4}`O4gqdgtn5k`~xV*Vo~w@*K0fD%hJj2 zm+Y4?cDs7w3ca2v5B$71x=Hn}Qqg#VuvAE+t%7>>-FR~SWEW5TGs}R*SHASbLlv~- zREK-wnkoYo4aR!n4N7A9iDL-DcI7GCa}F{-_QcZ^2|4Xip17nwvUt$H(soJ8CkWPO zm1F#85rnM%YD#+YMo{mEJNE3b{K^w=AGdwXy;+`kqx=Qh$RVEi0@g@}DDJ*ZlJxsF zc`1yNJ3DNjo7CNL4_4cwd{}dzn@Dk}{H;;@+`^PH<-JDlbK9vlRe2Zq_l*C~bRXRI z#N2$Lo>qKBKi%;L#AnG#$#X86A2&@-8Z|Rz))Bqrr0LVm%?|0rM}(PPnQ=t-^_#@X#r1^NsVujfahVGWY9ww~aO*te&YlCrdv_n(kSs`HZ787wD#D z95rj3wG+nwL?edDtZ4)hrMKT;GK^ab+|_88NfOAJ0R3f#8{mFh zf1zO##E;OOtA7F9S~|hHYrx%S^35shGznto(5b^q2NJ}B^{yK{*2wtl?{){ibsFke z>IQr)XGoi`;fbevEbut9a+)!`rz^TI)d*YkrooO0f$_X5ZhMFi_qgPHO3jbuO~3S7;d=E$ZgtYTX&;klNE4pn2|VhsiFIt zqcdjCykNjtGs!sF#8G?mT6u%*hKr_N{V7rBGrfhA#qDl-ZTjC&G1psSm}n%Ps`0s+ zVSnRO)80nd88jPi(R%juna*at6C8SM!Gx>}0@e$8lr*h>s#Yaf`@$Y&E{fgV*8Y3Wx9~Jt_X$>O?f0g5ke&YyY zhC&E!1@LpB`Pw-*S4Dfy9PHP>2DF z@+#*vJIgnmvumcCohRN;;Q{R%C?{^(uF0wv1R)!bw?+*do@aVtj;y|J3JtV3pg&yE z7}(bf^uCE|wMyLao_Og{>p^P_JM)#rAFareTLtA8>0HtBT-q6~-`86$VlqKo*0dfM zIGZ5Cdv8}QnLrTnBWDg9X?oZ8rpiG@vvHmAWpZea#oGnnt@p%tuDovh70VM}qdHwF z0pb;mXOFd+(-~h@{=elOZ`x>9FlnD#`gn&4pAX&VR;Hby^BK4`44)e9o3_vGo=Jsi zk}l{;#+WHvd!O4;V`o!ke4mH=bm5F2bid||G3h=1t9}%{h1qm_w3I2lKQmOk5LrJmBad_)O3__ z=og*ght-xUi$QMaYbK9<)FquvuaU_uNj{#qhvGB2IFKV7`xo|&0DV%{-giUi4e~MQ z)W2l$|DAV&P;?P<0ycW$_ooZgpd*a2P|2T08tOKp5oSllnd|^BJv#GrxUB-mx z6DPv_mhkz}i5YZ)_-_2s&u7EB&WC<&+$-qkps~Eq&O<-tE=pK@YHnwL|1y1Yn<(jd$J~tk@IcPKQa?d@KwD-OHUCFxk++E4~|J+?)Sm!DaKX*4y!9=dt z@Eeb$>FyU!K0o34{Ok85`u6pEQvd4`z4_dAj+_V^-S^z}*W0&jpYW9|o$O8!Gu2v^ z>R`Pu8LzM&*NE+N4f61IhOxht|)%_?FKy#K}gE&Ot0)BziGKULCEy~ z)MYQN`hwg_(tbL1E$9)&ayYF9);p4QerLKVy|R^ue-8EQXWpkB)`gPx5rjm~A&7%= zDzs;PJN+XW_Ft}dh4rM|c-msfFGux?5);}dng0pGOyLFXdB^&pGo38of9w5(!%wUk z>j+}*^xPQ&u>Vcb+%v%q=97t|f=7Q3>+fS@j*h)OgdjGLDj01%m>`r!@J5!vdeLgc zv5`jy5d?eWXQRi$-Ej;)wjSbb8>cb;5u{h1R5HG7h9dXFOe7L?o0AJcmEBK#w+%?@o1E_ zish&;W%A?K?~-+PXL?CK*Y63IvzL9&Ja@OsMs2x0^W60y<_h~QydST`+g2>!=-_!) zb7_V}?1uVANqm9`wO_|@=7PO|wEMkJwap?1;rN>U;N$Y5fb&F6a7G8D}%(iKxlEQ=r_5GMhYj;=>efC zC{zYgkA9N}6?=dhsG|Tl_vr414q$F!^#~r=BiI^Y9QBB!hT<&e0b+sdWd!db9zbn6 zK3$M8B={j8Ky4u7Nby7908mf-5EA|Vk3`Lw&DcxUH-O$z?Wgdo8ooIIL-DNyHAC$@ z3Z*SaJp@<451}pZftpc*V!-F4Q8ScmR@>Olx9ozLF{k+>5Hnl@$YNy38Q8}mW+=lx zpVjcS#pc6)AMyiu8vhQYjIJ%G5Hb*y20G0LTaPG&3<@DbcKn`#UHN;#uAn`M?;&Iu z{Urc04A4g8Pu#Cg0c6Pb40oPnh0V+qK!$W*`+NJ_N&Jhy3qS@nA^@<8I;jEs`ei4& zW%u9lWcTksB0g@8q3|*OnfMrbCRzr%hI(*9MRtq~gzyLPF(hh753C4C_ZP>;fEvnB zFmwzJkj~N*p}+)rzSnwLtR4*}kFfoHz%j@0>1$q0{{vP z0UQHh3JmD_fTUvlcLXRPnFDDch*A_lL6_r5w1f3ZQ@jDChuLK*NRt zDCqfKnP0%Ak-kD5Q)}J=sGcWk?V;I#2S-c7jq!8Hf^p6mkcJlp*7@|G#$%DMLbk3MoTE zhfke9ertRRDMLc{|6fQO6jBC-lz}+#w~piAo}NO=K>hG%BXCei85B~+Ut|1B=0OT6 zLqdn&E>Ax$9||dhLdrm#^4C52M8y;^tG>R)@CE;{(|9$JP8g_Z#wC_4aQ|NYQ1-kW16w2Xf{T84xrdVoj3n@j)V zXcFJZu8AyMXDNUA0 zGh0jQt_uJF%bkwih>O5~%y}FhUpn{7-iAy9!FKA(GC?Z4|BeFHn$LD(bLVp%kYa9V z2zumyN6e7CqF6ThccPww5=p+0xtos-lfhv@#=kFU2^^!8^0BO{WXVzj18&LRjqE0{ zEF;IItUVtFEBPys{=KSpCB5E%r#zfd{i|_&r%3$oqz8`bftAwD=YtMya~{uy&61An zWzIYS&)u2lCeyN=8E!1u@_QMNEjiK-V+B=2RvEN{`%ruk-&}V`9^aKrh@+v~B~|xO z9ciAj)pqw#-R>p!Xe5ObW5q+FaiW;O)=k9LVmq;`*iHIS`beC@iJ@>}7#u5xD~sfg zWf+AMgX~BMk9aN%L=$Cl{qs$(Nbl*i-cUF(6i$qX9ovDo72Y1f1h5B&6N|2EK-aco z@Y&|h@PNq8nZfN5M&ZOr^{o!cPT|DJo(HU4#^<^5_-p~2$7OJ&zFjoN88blsbkNNf zV*|nt3vFG%We`iRJ42z}ku3@=(-^^!ECy2pwUz<0W5QK^Ovw6Rm z!bwi!jVAi=F43atXUvYnJ0c1>1= zcfmU=l+j+pJKArJ8aO=9^uin&f4eC((B2I7#II-!?CYiFiBm`!h%%k@l+o$WzEemU zh~gAdhJ^2Wp6uv!50sxvtJ5He;t`CY58>V616MD#JLh!QHbMS-n(bgu{6hc9>WMI} zs||{DeXTnAx`rdiIV|wRW$|QkgF?zc6z`MjDF7%{3<)-NVcajqnzf$~4@oP_g{vV8# zF%X~`RC*#d{13DYr9T=iBj9rqG6D-gI3AMEO2EaK3qQGVKO#ZPkiSd@*^|9vkI8|{ z9@UHsTd@fQkb%uDA!B?3T882rCd-N44Jo7fBaku#bh4n?Yi3Id)P)Y z=op6N&OrpYet!-FFLk1nVDJ2#KZP8|v0&FD7H zES8{4tdGC~(A6gaDHtBx=JGfWvJIpQz-=L5aM(@&|OVXE` z!#fON`{@qY*3IBZjuxUrP1-A2d;uFy8g}uLL0?el7_!~oU5F#y|NZA|4VN8RmEC{G zqpRrfEILXng(s1`nUwU9vJx4A&36~b*zH%&RibyFllz$eKy(ahL{R7${}gnL_vRQ1 z9pj&gj-g|$rDvc6hz2seFmy6mGArBh_zpG#248?s3UIoFC3>J^K)Sy;ItJ8G27zI$ zi*yN4HrO0MO6%}No*z<4$XGqvOTKIz6efhR#9=#e5%w7!&^DGbxK1AE^cCcV=w{Ay zKzf1$m17I$UaJrE$-AJEqWJv$}VFZwjAv=-(VGW|&`TzG1 z&36lyIVgC5Uq3s&1k6)hI620{Trdx85u6(1V-9d$%!)^f9P-5VSZv)SY$~ROnPSti zS=f4P7j}g{h(3%yijI$!AFGPfa5-ENSH*kbeQ zdL3!j60!FiGSdCMGSd6KGScrtHCtzv6I zB=i#~FCF>BfTzoQX|)a>|d z7uLr^q)M7dA*6Ny8c9_siJ?VetoaD&GYJ?{x3r&N_mOsjhX8bX78tw)&LmP&&qM1U zV)V{9Xxxz8&JuK}+8yF_C5Tf{PRN7p3~U-U7e)|=R960w!|i(dI>x}-bKDW218NJ7 z>jT8!JeI@*0RC_z16XnZ4)7ut+sPRTW+Qza6BLK-E?{t(EL)yzV4yHVeM5kRSOG$u zk7(58I5}=;WNg$W$kv(7bm6kx0bf{42iL>(V3?XOUh*MO0Bs5?peHqTaARZWgbqS? zr6#U#Z2TLjNy_!V22=p4QT!o{uVZAW3*6Yj_y7WE0`5-62k-*}@aW3;#<=0HGrkE9 zFpZu4(S`8=r%ngP*spYz2^xPC<98P$h9-Il&a#7K-KhC*V0;QAh!pJ~- zD1Qyh;*avDFf#rcdv_^}3`svw7#R{e{LyDJd*)AJWJu^vVPtfdhZIJ}|DW;LbA0}J zZVDp<^*Du*(OnMoJlg@77!*dvUkKCU_m&S7M#i5j_bH4F3L^t?-1~C&f63uLE1bf} z_;dP)!pNX7GXBbPpr^c{Ff#rexzLmDl$)aa-$_nT{7UgF#jic}`+pinh6DqGBcJIc8nP+4P|TU&GXrunBd;iLGx*LX-7_$A$ZtO6 zzXDr}eF+GL4gk9B0$&~gFK@xNV%xEu*dF-X3&_g5;kq9?fOcVH`>=1|Zy)@94SxIK zx*KAAMY_Hw;~}2|*g^Py1u?(Hj=}YN>kr`f6Z{T}&JM92}Yc_$2 z#pG;V3cp(6+YW%!;6;cZ!4zIb^o5@yQG07^b4zPeYol1Mjc7;FotQ40M#d1ZZMZF7i3iERFiwcWNY8qOeL7ol7 z(6*+AD#)m;tg^hcx+J@F_y^`3ibF{xFB6cRrrgajvYIBl(WN~w|l?+jIpYpPgd4*yB3?DnUp2Ykju)+ z66Y%B6qK|P;x|w*ByX-MFRw1Is>po%`jM~yonw2CpE~>Cxo=QnX-&}iEjH5zt7F={ z`%#G*nHgC*1qFFoQ2FeFIuS}PB8IgIE6XY?D~d8>eDB}=<}u zx6cED-ah{R(7{|0nG_?lz(m8M+(z|R#Wdz0c#%+$pPQ9aRFIyOnwgPSEP6{EfPNDb znr$`ZHT4xG8BwoZzKajJ!ddEcE3L2=^~Fj@mMv@3;SonqUu4akpw<^tnd_BPR8n4A zQIeM(9UhyVnpqP<)~mUyUQ<|7ni&2%JXhE%j^UZl)SaShsB17~>Wsz9oSdCpzCL>C z%7xR%caPlm-J$clw;2u^h$-w$DJUzftt=}o%#4Uk$;!%X2_+5^3gV{f`ex0t%(&;i z5f#u)Mc=QPF?hVr@-LZ-mu~bpcDuKi5WE+oC6 zpr*32v?MnnG$DfiUmw56 z&!2fce*Egm!+=pQpWV51`owqcC%@KZ-44qvtE{c9C@M{l3<`-(Ppl6k4iSp2)eVj1 zv6@LyK~W`0z{FUOp1fq^wr}7zFVae0v4cZ5oNO^r}kS&|bp(Cc0r2qV8m^VZn!`ti)2 zM~@!*rPV<$lAOduTWzMl&%J|RN9L7R*Vk0l6z3!cJlTIYH#wm>f;d8`ifXHygvDhA z;Wub|0>wn1H*3Cd+OhwKtGB(qd=rFKs5+=#L}mQzJNy5WSXy3RQ(IP$m;UC$G{=a{ zs0uQZ#;V4as*>#Rv+Fg!sw0}SS2=AzaO~29XWrhgGukVOW@4}~)&J&x@BGTThWg^H z!mPM6*yO9l37HYZQ9?~vBW$THEepHC;PfjYS{~S~J$CZU?PtC|{?S$K6+q{~jRk>+ zPvtb!pw2JIO5tPuE)=9EHboN0h+gewwM`A>btU)MCXs!K#%l{4&!4{T_3WjWe|B3L z(MSwx$+-M=SVe6^Lv?XMcIb3WVNX_aLR}^NRrTN9*(r9usQu4xbBZ(74A5nFku%)yjmEFrI zfyhx?qrT4LxUNrSX=#y@JPn&(k`tLOiXy&;IkUQ^xv8qG z;+FYv(!Lc*q+rWRpg zLm;E??B<$pFqPq~{SRNfydTn70OZnv(plx@Mx{p*KM?AzwT;a! zwH5gb$Beo~{4}VS@)rkgJ_+^-66QlPwaQz*Fd9oLD_VAmX-W#4nzO<)p`MVguDZFY zu~c*uAGM2kJWPIulKb78FP;Zf=RtQ277;bqLWB)<<(1W~t1vklwyVD2T{6`3B+;*} zx}mADrZ#PX#=MMpb4xJGYkc3+Voph_4U;y)wy4SNLRu0%Thz3 zLw+LqiyP`%+uN#JB8F+Kf8nB}X7uG*h5Lbi;Y~SYM|y|1)CsG~sxxNE(G-WyOD#%% zD@oT{)hrS>3L96-ncWT?t8BRL@-=ziS5GUlQ8MAp%$C~v>YB<|<1qOV16I}MCI=Ui z#WmCl+v_UDw-ov~KV>NOS-R_~k9^Scg!XL2>d?f8btqYFg#(859)j(wD2flPi6l-D z1DeX~np6b! z!0;VVUDwps+Cm&s)cojWi%|T00?qu5n>?oH=6U^%FP55thP9Z;f7;y8P+nXgH5ThNNKTGX zQ;5=Qef1Al0-gn7%^9Ho5aL12&(qo)>nh8u�@6 zP{P#jHsmD+Rg+0Y^$nudW?{>51#FFVLE|lhGLU>r!Ktm3KOS8We14^BikBkt840as0|;Z zh+!Mb3u1h;!ilp`n<1i_x|Ze^VcoYX*sd2Q%IeEcdU`+iE(di1HFQYTr8;3LXz;+~6~vgbLsePY>lkr+1mQ^xZ7mmyMXik$0@XebZz*E~)_%R$>q$@xO56^K zhZ0p6i<%p2E9;}i$d86MH1~d5k{R!vCWe{76KGKmtlQFZei&w3YAG+L<+0=ZqdR3{ zu#&Yx7x?-U^$iuZEhn(ihQRcuB^k+)Z)(C&rCZACTicqNQ;e`NFE0+nhH_5qzkU5J z=!s;~A(dw<>uXBOYZ9g?jsq#Ae621mIV6pM3GxClR7|v&SGBe^H`ec^Vc!;7(NyOD zxclb|59>sb7zV3&$S=NPVQp!3qYE}+Al3()S(K3$^R`|@CLbau>WhT!ZH+BqlWB%k zo&&LIf)fYMpU!HB)M&C9OcY!$YHq46Z+fPvIIK^vk=WUq)Z}-GA;fuNXnSRCTYIyx zkcADq5v+~%UbtoN8PBI8F{pKjV1t_;zizIrt*)zHMN=E5tc=a8EYFFFu19Hy)R(u5 zn`>*lhtR$%Vq8G>&vTq-2mQMJXya50g23&db?wfMdUrl2fO>+`g>I4?E}8WaZ2 z9@GLNzoo9ekV9Kg@&Lz%*=*T%^5DsjjN#>L|6RrFH}4W->M(J#!N}8nv4shP4xMK`jlSo;M#+l2cHY z!+JewE-H!1AwWO8NDOJLYG|#mD2+0})>fbGjSXXL-g)|`WTL%|to+c5XJt*bbrqsy zO`0O6Ov5ay%8Ih$S_x4IaS2v7b#)C*^;P-DdykH+G{rQQ3IxZFJ%ZH~N)2U;L*BN) zdZe=61;Yl7R>b6P)#T)ZVlRT^S3w0NfRDtD{c36hXJB6ur{oo8?cBEY#L2W~A_Im9 zP_E`>ZBs>2Wz#)%+Au3k8n&{rAU8c$C>94pdSIBQ+SbNKVMED&Y(UAoY1jbA@3tQL z&bL{T9<=)BNv(}l5V5GHsSVmz6EH>fO2b+?)h~WJ zc=)F?MNMScLx=*OT47yPUHjQl%GiXlG;C8{UO{|l3rag!TvuD!P*+o5%*Qqn0i)z~ zkDT9s`iD3XR2sE>aO3N2v9P|Pxxy5q^_i$3H~4jRes);#8{#_R!>QecyUEwu0sl%Y#gUCMJf&zJY17wo-IXm8P_01SYqwA-^yox?LOyS&W9N zR}~6dsw$r!F#Av0V-JUe-#<9_OZ($SXbBF=t{%-^M}*a{Tp)gW8z`-z9AkE)6n2=tSU=SOwY(F$j`}zNL0EdlL+NGh@Il{uM-$*I|}#6x*!=jG*OWv8d5rKE{d)Z?OKVxq!A!=s~uBO=~~ zzUvbf_3qW1JHZKMuqqUbD+oF7gw}yIwG|D86R`mnJT*)sSeTa{mP&{Nh{w>=1kqZP zmy(u{mIF43oPvBP1{Tg)si|oxsmaMuLSkH8R9IL@c=(&p(CByJ5m*=;_-qIjw_q409nW^W%erP=VLPQ;0(ly;^Gu^7FFt@(Z%_^F_Jz zthCHrC@?)GB`qZ(J}Dt7E+!@{I5a#gBseTOCM+aOJ|-eOR2-}jRnQI}Vl0%=1p0kpK`yM`k<9|yk(-l}k(r&9my?;2 zoDwHa=$9B7{SHcr3=a;Bii-#fjqDd28Xg)R5*!}t|LA@~6;!nj3?t!B3L0uPib}JW z_0!rCqc5k#Z!5`o ze0peR z=1L!IYF=$oYCx7B@r*ERE=bDE%g=*8$;`~n%*;qmOifBi35yO14E75N42gIZ6c!T_ z`7Y*^?U`S)qN0LALIVO~;$y_2^3f5YA)-*lcft4X#R?k;Wib)?tiHA~y0xlI&hh6gwL5zh%@QEhf&YJOo!Nlt2JQbI;@0*r_7$mpP`h?w}W#K7p-*wonA zps=vGhyCR+U8n8ao<4eV$0s5>tbb@oL~M9yXjE`ea7e`4hmV3EWTn7G2*u3^OaPEQo)RL5Tc`7lcV$S!#S{AsD6#(vnjWlfqvGMZb$qh)d6j&Wj97 zdJ`QG7xXG7EHybj{l;hvwv{QnUHOm4Nxz7Qkp7WjQBYjuyP!7#uV23je|6Tcu$fR5 zi`sl+h2_~rWg3x-HO)>x(os^n+E|$NHn2%7_9y&_>Ehb#qztf{fjOiwFC``RbwFrL zc=TKUkQdkA{PNh>D}eXn@h!jauOGU8HzQCR`(lR!@7jwWH~#!GI4WjvT=cupu<)3O zkl@fDzgMpVo_XCXg|XERt572PPEA8eW?4?(L!->TZ2M*mX4z7n75k*%Iq`}x6E~G* zgC(q}Ff%PLHzP46G9)t0=kc@4_cNlCs@{~w#SpLKUZoTV)&{@Xc9iqe*x}zLM0mdq z@VfNov0r3zZ(ybHkf`YJ;K-Pe0I|QKU(o$uGGT$N(snso*jScd{8D|rf!S@}SxN)m z)aItV@^5Q@K?D#p+v*DQ@^iC`OY+iFlcN(7BZJ>PIq&=GaZ-MGj_--XPG4-=u-CO zdAB##m(|99)o-QU0YA6?7`wGFJNjWB(I)mIUK6w0D)X|z?p9KqlNucppA_=UKO`W! z*!RrOZWfF+nslt6p7j{4x03wlLkDO~>N|Uav*Tf|q0RPNZ$l$Oqau7B5B3j_j*E{C z4vUD540#*!`uVFD&z@fPF91q6pUH;ha%tIpM|JzPsb}ce#Eja!^uX8cBGC&X7{-z! zAwta-=b7Y}Bt=FhB)@&?7afcBC^9&3gTn>aSG*lhgB;WPb?(uXJw>1(Lm zcfzzjDii)6Z*LtQ)z$S4pYcg1?n*+E!QHLJX`xV{v=k_X8WdXKhN1;h+#$quB4f!| zCO&a@cbAE~yUuynp3wVw{`s!!`{TXdD>ifHoU_(mzSrL8m%YDwhvgQfXQwfxK|#6o zB@jr9veR=5GgFe{lM^Dj!afC5hbgj&p@EJr`JKaRd*3vjCeZB1TIzEptx zxv90KwY{YwKfAm*BQmb6I9GCK!-2&N<0Z@3_;GV<{e8G-iK)KfEBuzVzLEBm>WgY> z6cUL>HC%W;DJvzZm{}6+8In^|Q3_!rJ2yW)B_TE~JuUQQ*bt6)d3O&E^mcT6E!nKG zr_z&zt?cS;stiw=Q7B^YbbRk5H2GSZo7$VJ3rouLBBRq%gs+a9(vLkmXuaHKVRiCK zLt~TY!+Uk~b@q*>m>cL(Y)W#snP{r0tkj`EYwzHjh?*Q`ewK*Ek1H!HEG{c6E&%zb zB_<|?az2($F^4+~5UmcRMQ#K=VL>=i2`J?#hehxPQ-mL)dsQ&%Bt+#Wcptxd#8 znrCCPm^qm#i9+9`f`W?5a`3jCyzGRy5UIdDw6)V`thc?rbJTT#^>3<;AL!JB-QD$t z(jpn2iSL?1qHk_(EKSR;%n#vxyu5YEZtF#BS6GOv4y>>?w^*#BXJDXhpsA~;!`QxB zO-D_O)ABV{g+|@m8h21nU!A1D2!~vmB^fDcxngc$YDrOEE|dbiUVorc0LzXk$ z+uh!mzF2pOpK8%Y3=@sD)+R{?Wq3CJg<`m_7Sc{*bw+wgWh(Ff^}QN|L!RfiZ(g_l z^r1D(4a-+7SZ=DNqpPj1t)Zz#RZ~^hc{h1ilTIhlu6VD+)O1vJmSC8!CG%NwLUc}k zu!}gWs35PjI5$5lJt0yUBn|ZDjZAd)ba&r2(Ed-KsvQaYqpQ2AIH(*}3i9wnkoX3w z>!HQlQeIeCoGo~HX@eGZ@&5aNf46npwvEgc3)Y+1Fl@H00GDHEYG{(kWU2~jYpKYR zLZy<4`q~5vk+7WeVF{6pF%5qYFHFcSkopB>loaL^6c&L8M21F&i=BL$N19suay}z% ztIbl~jxozeJ8Gih6~ICPlt>DE$!K*s@E|WOEG>`pzJBDe_Ob(qzudjW!rF5A0xQ#{ z%T_P7($df|U23XOGt)BN{r#5=(t>jqL^_2+AW{ezk-8(O?#)7N62` z)Rg4J5T5T%hidt0=Hl?K^JJQeXJ=!5nxHKV&&QeLO_l9!&E*+I#ZhlhYcZCu(9xg~ zsA{@;Kw2M+Pghr8mqwq{&?8`Kx~7axPqJMOu&Q2MmiTUmj+6pJA|NU-qRyYCOs+PG zyy)+uxZs2+H}}Ybg2IA~R46WFk^uJm`@$eg?Q3%h+L+3bmS%aGG!-V25qJ^46WR&2 z6|g#0m|l<@bN{3%W8E49Rdt5CimIBnu7RPxp0**FfC`zWPN%_Q2}V<;ndB#~wu-Fw zf4o*tgFHu2#bEMDAkw}{X%{oUG@@dJg`&*x(8M5Tc5Vq6LV9L;T9hQr-^=#qXC$k{ z?qe8%?%LH-8_S1|P&i(qG{wU$)lFS(MOnG=5pTZSx%|uJM5?NqhB||xs-~`OV5nos#mH0&jZ9O}8EOoMnhKr5P$iHkK!&KH zt4bsh;G2Mv7cV`ubQT$+k_9So2VZ*3FK(p`*jZv`j#()oLZ6o};!BG2(Yz-oB__i4 z#XI5P8G=bdFQu(AC~#B}f|uf36?2`9Z5=t;rI}@pme`sfc3GKFpov8U7HCu&okmk- zsL*LtaD9wOB2n};h%_PrxS&vHF*P7grh`u+V*pl&M9X)~!p@vqyNt-#SCPe$0bJKx zKH0?u#f7Y3*}%3+wkG$`u6B42*6; z)pW>Bm2kZuJO~3#AXQ{%C3+sa=5PXAQrj*kmGOh8ff=GgJOdx3*s1V>S0nVJmpj!YxK%Z*Cq*IZH zm}p`r6Dy)TJ>FjP%q#)wIr#-SNx=us`9E27cdVs}oa_lQ2*%5BgW2|`j+(6E23As!*h3OFB_172n^ zOC2*a%#2eI?c?fr`$-ZEJ~zKGKQlGt`%NAmFVkCFE64%KF!c=v4HzqW-Kkc*)R9h+5fXs78vFEBQp90>f%n`_-3=*8AN;Y15>G-$0 zMD4FRc$sxxzQf){3^R(RS5ElLeP)Yo!!oi{GScGXl48H7oMOLl$xHMnLPaPA23CzV zv=ryU+$QFd>BCz`wyribFxJ=A(9uyRgL4B>dE=DeY^lQzX5Kixhe3fMEVZCqEsS{y?Y1+%NvUzEsWCB$31_fFUT@#{^GYy< z1g{47TRYp?Qkzqmk`uds>*2PU51UsQ>w^Mx^)+>9KpN#*kT<-7(Si)12q1z{5Y6By z8FUVb2+jcxvEw;U7HgWHNIgY1reT_Mm?dzo&&2j8roC8z(Kg$~rbH#g$3(}5|3KK{ z0rR1j=IrvU@V4(U^WAo=|7>1j1nJmNPg6rj6>fn-EYdPz28OKwMnL^k zr6_2KG4zRoh!copx8LV5;_2#jU>TSdoJYk}7GNtPvfdhF1hebGX-SE3N%0YZKM>d1 zyS#hzN{CHK@G5-4OjB!7L2YQgt19fSFxFYt}@ftHdIs9gG!tRp#%vZNdY-H zI66@aL=LI|P9Q*nc8J6of;vV#`HJP(5_E!r@+1x?GS&vqwPf4rYr2%Omv1IwA_)|`s+sJeZarnQZk^&0cFM%voCTG~2V+Ulw( zm?^NCe;slTLJ+ci1vsQqBoKAsb5$FQV+%FGVt^eSQ-}8U|{tuAUx$oJFKv;A@R7ppfdSPlm@Y3dpp zDs(cHHj4rq#3E$)3W5pp2W2J%yFffB%>e8GbglrWMG^y90aF&}wJPCgu5>M&WO^Yo zJ24?XF4Eo_Gq~^J{O0v5(i_1r#396l^=w;XL1O_g`VaNvc>7R6;urc$b#%1V=@fNU zRVtZIMU)f-C_~W@;We^6jGzXpAi(SZ6^9UvfeiWvOTj^8&?#5i4FO|lV%yVW*1<=# zW76#8q__y#-)4r)*S;?A-@GBcd!IfNgxBDUM;glOT4H2Z77>rQvczTi-x)2`Q&XqW z=qe-S)DD#jsRi-g>BvznJB%A2~A(E;xR3oN& zT?!SA9BCQq9s(W8AViD+12n*hYBmhSklF$$QqfT)7SItQPepQoL&y{`n+LL+@BThY z*_Iu)35C{m7XzckJl0J!jJnO6I_2x_Vj3y~q<*g`~*s*Xqi5f~iBW|;=6)W|llhzrM{Lwoltba5?zsQhc~X zUS7`MbAGVfG&dVdZWCQ)5dA^RU_m8NLp1pWv8xQ*& z>+s$3!p8F4Kg?G#Hd}67ptZor#CYT93<8w_8AE9VaC5>ROmqpPI81#GGoxB#UlzX7K+@c^|I&ktJE8hA(7h7CcJ^|! zr#^o4^wB@gqoJ@=WinS&T3;G-ltwkSF*63Y(KFUvWS|X`L^V3N0C5rA6cHrSG*vYW zU|wgShK5XF7?Fv(T5udV20H@BLHr=8e5$=r%C%bR`|;I@&lfGgPLw`|m34yJo^AWr znL=_VYS}y$vt8Xh9q>owr;qPGtwPM0j~6#qm%19lYL~g0u8Fasj-I}rks*worp8bu zPQxAMVAiB*YN`n~p$Wu@7#*q^I+6qi(F1%2X%oZ%)xA=Pz!|~HCZuU}s?6Dp@NLR< z#IVlcZR<1$FauFFUg0Wmb#rq0NPG79>C=06Qxsvq$Lh{9c}31OHH>IuX}aCO&`?KL zM@QdO4Q4nbssW8eQ>9bLnwYkxj?MB#R!~pDbP5%h7;zRXlnmwqaU2+$&%G$7BN3uf zd!hN7^Oqn0ZjN1x{+wuOpsROqttrftX#{PX-To4HcQ@ycw3knwK7Dv4a2j#4s;RoB zG#Vn0#h)%^ZmXc#p|7W-qlQX2DC;PyIxE&}KC$VG9Xr3;xXKc8C@MOT5rY(n;3$yX zK_?V=1H2)3LuVlSBqBM@V1}BQhI2HNXthLt&CxY9s7x_zx!I9mvBI6;;z)b(Fo@DxWrH&SW#%{883tg3aOJw(brkGXf2azt*K3itd1zo z>wq{#&{Xn4Qvq8dqo{*TD@~V(svTrDL}1$>kYfak5me@x^?FdC5viLD{|sQedbm3~ zsl0gn{E6*NH(0cb09IB^HMA5a`L0-qo%w0o)&)o;n%bJ0>U!qT-%?s3MnZQ&l^m-4 zi5LxrPF8{Thf*a#5JfQ}1M)8l`k*^>719>`LD?D(EFck8v4zq*+Q|O5|FChfHptCl z(~9?OFJ}*LXJ-}r$4?&H-mrtt2;xa+qM<%7_Nk@?ZH0-xma#r`W3&|-I8959%z&O3 z5(bQt3WYB+T$ukFqK!(JHmt~_egsZ1fOjMf75EK@F!FZ}@EetIa|BI-_SqGy&@G6B z?J?h~gSYE^es29D6UZ5>mag&eW4U;-oSkV-&mKMf=buN7NL#yxE6WSwej#IOmfAYH zx|(`A+IrBFpsO&b8XB4uhAv<(qmm0q&`q?Ltb>Ndd`XVjLB~NFMwp5=kc5sFk@8RL zE1h+Ie;T0aD*@E@L-ur9#IfCQi{BzYN4ZPohtqqGEraXUEWPCC=i%Y$w z;o^2s4+-qm0%QVQ0bw|Rp}qlG4|+G|rQXJ>4){>mcBS^1nD&jQ)g^ewevInixDw{| znCbm*f4To9tjKO$_fF#J&SHId?@V`k_4vhe+nafF;dmo#@xr?+D^jG;bJnxD=z55% zrlqOSG9{aDfD8qcthZ>;H||@$`|w`ljRzNM=xo?SMY_U4N62=N(SWys>uX|$S|GLU zV>TETTmDYr20aCWHKwh$=g;@su*Lq@K{P~c`NQM)?awm^TlVf^2Ya(vULW7v(>}a@ z^zzxm3o%G-hq|h((_%JYgiB4m?LUKX)YY{0zZFHXb}=Y0H8Q0Tj10(TyROLxnimh^2ENI3RM8nOQdM9YpOtfev@QMi`|dN)g+We_4BLW+>5zZ$IKKmoi+JSL zi5DM!Wtd#qbuA>!&zI%p;^3t6{@L?)&us5SAWb{3C1lLKhJVRa7o1It zurDVkJ19tt0ijgXP3y63M-3QS3N;OFt#x_gBZhWjO%jy4KpFgup#eKqfIf=8zz67Q z4(v%y`Hn!{xEQGrlKKkO{VHGdt-=m<4Y+;Fv_c$HsWi;c>EXqNAR~+Se_Z|e;Rkd7 zAHVSn5qh&Z?jFt`Ro^~+^5)sY>(WmQS6rKYN>&yyKZR;69m zfKmq82#NyGr9)u`gJMQO)KzK)jshP@d%BCj&L=VY{;yzF_C|F7I5YkIb|Xw1gty!M z!v}L1$2tE?j~yKkoQ~c50=CHeuvwlSuJ7n?pFe!{)b=m#OgK2&BG`r1QJoRN+039U z)M4mo>1t|G*Y@1gJ6{;Laknbi0Gf%TQWqr=R6n5N3b-Pw&gTs{h~CpMEr{2^@*EPL zGOJ^jTi-E@XZt)484`$UcU?mLH<5{&t^v2a{9f*j_S-3yN!Y%Ao*o|V@91w{-+lS$ z$zR-A#M64%+T1Nqj~1=L$R@hWzFYwFGt%zbB6eE(j$1*?febVWz-$p^6p)qbf|e1I z46p!mHDDMxM+s4r4C*yI?YZ69gZpk5%jkt4)s;dA^i-e{VZ+@lLEP zfWu*XdwTiU)9qi~c=F`_buRdR18&k+6)zKl=bPSY4YPs9t*WkDUS8TCX6wpMqnZjQ z8iQ*?0f=;?Bn5mS-avp9)Hr}_fx1b`f*zQ|CJ?h=&l`VxvJ4~rVi!7GAiMb!r`66q zU4Kk4+K6W}}mn3Fi$pH5uxd z<=4-0T78d~JxBEfVnIn8SW?OfMvewghE5g*DpCb#=~KI5US+6OMFN9F1~njIy@P%8 zY)gXJx1#I~Py8nbzhoO0Bzpslx9lEd_^m21!i~dI-pbk$>rdk*exwz;qUlA%2zo0eR5ToYHzw zM8s)0W}$Y)J#KcYAw4OxFUd~g@N_J5m!~XLBn;sD_|AQ_9f zzQ*VX*(oD}z7182jxBR(K1g}iwt4;6qWk7Z7qbKllD?4^ooPsgR)U_f<>#Aq2n19pq`9uHqwN+oHbL8AF0W&}$P z%hzntS6zPO#G36JOrb(W+R!_`8terb3SgbOR+D^ysj8-{P0+j`=)^~| zr9N4sExr-{JUsY2-@wq|U_k(n<>T$fEH^vahZleT^XSgY zK_xRIWg?G=z|S#?-kEH?=(IYGg6SRJ1M|55<*-nblPFN1qG)0WX69atk61W$Bs? z3m2K%80oB8wdRXG`}bKhponMOkSqc5p|cVH=m&`l`59)#{LUQH`IglQd$V!_6Poa@ z%(8a8;f6~{c#uRIB;xQmES9&+N4ov<%g=2u`AsVMfj#OI@u{b~Q%ua50owQK=M3BxR*WIBRhpv?gTC=R104frd zxQHXT0@|lm50*nBu{>-EJ=e|8l7Stw>7m|Xd@Q$S2G2h4Clrf$My5|b9Zs1 zJ3qhn(Dq>_T33Y0#dJf7-`miT6Y7|@4xO?t*%tmSh%)b>zy@nu4{~20qz%K^)v+B# zP9IV;_nn*m94MptmNK88Z7w@Op{-mCF0cJZ#Fzr=O;gw_J~z=nfpcP<;RLLlO;%Lf^?Blb!pD=8ly33?4vR^bunZq{e8W{Fu5JMf#XiIWD z?VI*O2U{C*4JQ3sFb_kSWTP^uZE8sR4SHYIVJMnFs6anJ1=Dfu{EULVu2wUB3iA1s zg|_6~HH9=yWqd%)q{eJ$A%bDT?IQfJhokFd`PJ9v+vM`eUbPVoK8)!4p_)Svsmy4 zs2_Jn3^fHo^BN)+c!?IUc&K^uFB%o*l%z%XBRb~rg$mfa`$p~ar#Jp`tZfW@L=G>STR)Wy8UiS;02gdGR)J)u0UH8g-Ap}o$~i=bW~RU z_AU?PAM-5+-~`s#DF#QrScz=_`GYn#p91rNtq{Mqx1EATGMn3hEd$KPKG-u2_2CS# z(s=uVmmq-47YoD^iAcob`1rbccsjeje@T9E@6n@L)MeG5X_cJb<(0^0VnqFy_-UjR zX!1hm7GtdaDZ6Fn@~?_za7;PHM=@Oa4MClFG;0@X?rHls!7L3v(YTy>4PKbvj4I9K zGQD_p=%I{JcnGEH?(g100mqx??=KPsiUPQ7KbEt%r=zo-9r^YBhd#5)j?!Y_+|NU6 z;WhBENIm<=2D_AyqbdXo4VWA=K2|DS1IW=ywC$E8Y=aJTLgsB0q9{rppgW*!o-wpy z4kN8d9o!F%O)@f3wN3v7rFfk@dW3oS%$--+lap1^u7B8yWnz&afbGW%;6RDQWBYl! zIJmeuJ3Dtn1Cnj!cQ?zCl~Up!3}7iHCHZxo(_-#S^_V8B zEf()Nb^Ow6t~gZ8;d6X_d19U~%a7~h<%2k2dAhkcI+35m&&?^RYbrVlUKtwS&ds`S zi4jix0wt>UihdzlVEhh$kJJv0A0<`T0-_WMsw>Pe%CC4FoJ1thwl9XFY|~@by)TSl zZH@%pU8bsz+5Vpn{^{Z`5Q+T#xqfW6AkaSmzBt}&zK@far@NDr%X`Ad{y@AESDk8? zUc^jaq?g#PRA72k6$;%|0srrdKw(erfKlr_*$DcWPanuCtucbdcTf^x1k3XNW0;B# z1FBIK%cCz}eY4gYdQ)g8CmB4Rx$BF|u2Qi-BytW)T>`Pd-(Lt7JCEn?>gnZd|Iy(M zQ8vFy{_SK#$QLx57X?}NOQBPxp|gH8Sr14o>Is9aik+RjfI3X(Cy*bInQM{m$v#!9 zkvue>;oQY~nxF`cU4Om2eSD!Va#I?aLepSs8CV{>%aQ~NfdLNNhr{JU+~f;HY%jk6 zu7|s)r_)EfcMil3#heuODOgO@1^mh|zMWR%asUng1m`Fe5R?!2KS&K9@ndtCaYQ0& zlQ7#pA{OXz_)*}9gl%gIuz*&d%Hop`A6z)F*hHHFjtypMu!6Z_-PyPPK_W31sB?UM zxKK*)`2hkx$IpkuXL+%_9PRC&W)h({fp!a6&f(*Av1e#HKSvhGj+#TXF}GkcscOli z+b}XlO>eS-n5>aep#gt3_Q`Y4`L_(fgS zV_xY64oei68EMzfm8WJ?)WG~K+ryCJZMyO`VffY!g|L9J@N}Pe|Nhf^4B+8f?WKpW zzkd7Yp(Bg+RpIF;SSzwJ)mpTR`5+)DNWc?vSk4|G1{4tZo__v3f2hFOo_0^)yz-D$I$X=8ky)&HFv)ZmP({dG1QIV_5z6z<$?ea-;AYGv}0PI{S5Ctgd3jF-IJOu}5tN8h_+}#|U zKSsfm_hP&dH=ON;E%xEB&;I`0%kBfmJI4Fgfptc(j5mxe(lA=EeE&D+KlsE|_IJm6 zoLjqCW68R8TMq14wtm^R)9<8GQAk*5P#`X{=7UlB3k3oQa1dzxxG3lN^0>ZU9_}s< z?*d>e4i3}`@WYd>)n&Pb>}PL%ViURk&p3ABx81K?J$G`!dL5>|fu-S6{UvLbY&rAo zjSnuuTzSv*T#@s|uhx9?#i~W?ckb9^W3m3+d%jQ{7!(>J2@Gb6{P{d2Rk1+8@$+SK z(I|y{wlKiY+lS@i=+%s#OH>Z?hyovKt}ZDojEfcs3MYD-!ZTd`KZxDao^bxYYkU3r zg@3Nxcd&iMa+V~QccW5oBJItOJIqbKxwLcJT8oVbjy&Lnh+#$_C=Lu1NkWW;0{;LW z*B`Q50Jt*;{Mnbo_4VfPJrv#)CzlF%EO1`FOQFTsUt3jNP>`RLkeJm64{%SlwB^@_ zrzXd8LQ{iM_(9RR4c$Fs_{1!3JlXX2yNy;x3oKS{-*Mu%XYLX4!C|4YARwX;5(Gjc zp(sG)&l3qnLJn6T=0Gg*1#oaj%3ZXfroS|7i(^Xqon4g=Smz@)rl~mO@ z22U#bZ&NRe5ifAwK63_`s&Pgr!PMA6-eVEA|rxBVa^>K3?{@C2?RosSYIL(!-mcP zFdrZ$5eNm`fB-+P!iVhT;{vG#0Usur(%=~A7U^c#Tytbq;zaTX>Haa>bH!VLsKdmG+H8ENw6Gume zhe+Z>LilV6j7c1ql9-yQNW^3HBEv#L!=fTWLPLat(4Zh8JjfvpF_j3>^o8#);QB+o z4!O{e4*|&6$Jc``M@SQ5JPSWCRFenW%=6Nri4p!CP4uLE>DDP6KRhPUIJgfKAtR} zx^bl-kyZA>e#M;JoV=v;bhv3+W+G5bPmU1BW@Ka~rY0suMJGfjC8Q{li19H|ia7nm z*yxzpXqhY`NE$2=28W8pB8fm?B9cIti|xzyz;lXA!Mzd>8nB zOL104Rz`X{Jh_*gke-^Fk`@!6k`gM7O^Qp5iii%2hA~9N#w5nY#z#g*#l*$N!0*V2 z@UZZZkicL?2q`E~EHVm_io98VEFV-$LLmbV=*#l;_41aFDhYi7geL0qGqX~YQ!>-i z;IXXu#I)pu*yOZ?z{uq2n5f9uSXl%JD>54BMMcJd9m3J**yza6Fj+W6GHGyFP*6mu zMvzd*@kd?_ro`cM6?`iAwwq_s93qqjuB|dy3shhqd{U|+c~e4iVp?2$OnhosSbR!S zY5C;UU2xfnp<(SOThoUYjpOOE&7H_^`s8;DH@9oK)PR zJ0~VCJ~k;H?hG1^2$RKy^Mw*wbc`%2J~25tK@qP=(vJy4pT>exLPb(YYk|RV_fSO$ z5!^}-rsM)4m&@lXV?Wy$YV5fFLFL^S&&ZSGWRWp(akA*xn5c+QesrXW!w!;#N5#a( zB_$>#M@PrS#zllF!YL6kA(F5lMWA|cP;f}7L>d|_0oDU`C1T)*$CHTs*c?934{o10 zJ^*)5!FNrT!#*cj6lhWw94M9shs&aZ+1!wDS$K4GJo=85MMMMzg$9GwiiLqe(CiBm z1qKI$0zk_miBJcALEhqudH#Gh+neR#l{C^1_l9T4#>zuO!oxyB!XiQ-AW1?ZqN4=9 z0Wl#V;nIi*SxiENEFv5-pd?5P<{1EdfpDfs3a

04=C=AusZ|K4|s8#Z6k( zt7LlhoMJL7L=*-r02&Tl7!(p78O-$w3xgm906CEn5n*8avM>=;EfDbq3bA@1l&~o2 zfVXjY0xf@m04fQ{bG{rOKmX*8+4(!~f^;`j26h%K4G9KI3x}3?ScK3^7=}_;P&mjb zG#sdg2n13n|6qz7AeKU%5+sEv49yj;zXo*B!Gn1mUvIXzq-wkyI8MNsiV7*uKR7rf zOe#T=3=R*52oMBn3J!{j1R_#Ult8Eu=!yd%2}52ML$62z_XqxYIA1lu&({a?GfS8= z&2M#uJKyU|1raKm?n35XT37A^~s!gO57_u~lod}x#SLeJTo z&GzL(4a$SckVA)+CO@txH?^fz$=i02;#6HY+lK`iUKAjNX*4pGps)xiJmAjoCV&l< z2iMor$H&uy1><6|VSd9#5~Z`fUETc?YA5E<&EoKF$cy`O16V#F01#|I0L%%60U==` z5Tr;H5Wr`%Jbd65?p_?07pxcf`awa#^5gM29#juEescZbTr=D$65lvAkP*gp^!8!< zKqU+D9(2eD;{{3hK%MpWqqmobvlq|T+neRdhU@}4#@E}+lN^%OG@@vPTZH55y7MDk zeO=sHY;O-Q4VOf5#b_==Cn;ln87@DY8(nk+h ztyK(`C;59iKqtW&=F+}C&~EWyIXk+zxjVW#ctR1x@&eg%J-oe~e0d?+^2u2Qu^57{ zp21tIV})D?4=0w3rx(l9-IL|z=IO@r^>T6d_GNjx+WWe?yLpOa>6N3<>0>;O@tdNK7d2AAp2CPlyPm*Bov!JK9#8 zQ4%c+4D|8#a`$zHL9$svqKJf?`jJt19DGuFdLTSd56K>(u;7zJ{jK#?h4PY$?8>Iv z!NK0?QN^(GECD(T2*9(;(0qdq9O_99DnIgtSCcqlPBEZ->jQ7wl&}8p0Rf_6{r|Ze zObGwKV4GC|Kg1Lsomqq-P)P&}i69_%!|y!+D0x^3EO``Q9}%eJ*8nTIA3pmRRB}52 zNN)WEE{Q-S=Rqa60lefk_}T>b*a1+9Ta@=gppu_qyFP(R?u2*f>YdmDC8*>H0F^wi z1eLr55R88U5aV_1_WuHveDYsV$tT!j_(DLEFE9iv`49X?ppMU!?_PX5@(kb~Ujh8% zd-(efvjb4b5AYiSMA`vVBm#>>0FsW%FK5gZUb`rdprg*16P)1$=Q=7safEB$!M)x9 z1q4rt?uy={S8w3{2)GhKPCik>Up~a{{TEd7GJr{52Y}2!;OioMT?SCe^8hD_KqXHD zsN{Db&%@Xe>R@^2K##e8jR7=)z#hA-PzLG(AK6Vuaq}5 zHnlYO_70Cv&m&1v=cXq{`ntOnof>V;o$|5{d7r$dt_7YV(ruK>>ze8T+_0&sqibje zKnE32c|QRdCKI@5xWBivy}7Zswjrk=4axzLhqF^$S#3Aop_3pp;CfhKGg*yV}}H3v(hQ(LA1)^YdpH_U~A=|KuIEPFg-NSPb9^l{J;swT(@! zof8Rg;WS`YOpW$-cJ=qwS0;xihT6Y<^YPX1_ikK$_~_ggCS%!hy-n9VQY!K?i;7E2 zD{3n18e3XA`e&2iT7Z$99_jDtY42>Wh>H>ih4bFoesFLJjEzYy?&weQxO-}?fj)J^ zC2mYwUQtm=c};Citz6#N4EQc7a5=z8&Q1H+eRlq z?{m0T`e9>Ds`($>tjxU9>dK0mIz=TJc8&MXrNOm^xMFgozpc5kxi~gBDn3^7=E3bM zh>LI`!i0ffIcuDKYuQ2_qQRcWfoW9$9#Gj(UtU^S(GBEr-2 z6Fh(4ciJ(hZW705hU;q^st21!2Ipo06DagC1k#LKOYEWWjd2y}0t_y&1 z<`E=knd5`~oedSKp+O1djq#7a+q?JL+kYN}|DLn zc%d=2w{2dra>K^;J60{*yzlUDzg_s_{xcUZ&krwdn_aVg;B@ci zR#Rh)emkqYv7x)IwOL-3o?6t~5fLKf<8{^6zVy$5y|pPaTKpNP(@tnF&=XlZRMNs2G7uj-mb@R8W0 zVgzfTROQJei9-M%>9}U|(iO*k`19@`ci*u5`~n0LUq0W%mm4e;$rc2Qy_{Y>yZ`(1 zyDNV5i7jqw?e1x7?x;f;}+<5rng9n@E?H81q*U$q!fiZ+1IW=d|HzChYhnA-O z-#@Wffm!t(U3~+6oeh~#p%>OxjC{h6937b)XfDq(jSG%J_>s}aEVm!|&Gx0EyE`vH zn$y;bAXF#8f)RY=P)%eI-|f~-yUc=$Ch+f`o|f$B@Q}pD($;zS$hnb`v4QrMia0%? zq!!>K;}7gS_4Do5?^tXOJERm4DiE@%0{WWJTAag8W(R9!BJVr@i79JnhQQa~-dq+R z`qaO+yb>@Z0gZBOc)YKnr9Op2c#;MXl1bkj{Q1_yXU?7h?9jqd0E1Do1t@8KIWnJH zFVpIpJKDQj8{}1qUMqf1uE_6GVn|L7jgPd;E7LsAYd;1I$)*!O-T3>lgP%wsimRFF zgOCF^z(>nuo_}#Gn%g@&>nj_oi`=lqK21gSN*Kw>q0#aFmX=h%U#|m<EPvYbAcVIUaE=I946i@Vypy4zdiHPtsUZMTMs(n%$Z_+VSNTzu`b0u6k^ z|G>}A@7=tGq5d)T(@Gf0$qJ9Zq8mGU2YZ_9YjbvBlm`{Xr6cn&lH)@YV=yHDzZTmA zjHL9lrSG0QaDpY0^q#qS7|F=LeC2>E+|g9mlnX1kCu+;{Kfy>&4UJC?HTQ=dG&>70 zl9{{LpLy-Zl}aQfpI{_sN}jUnI@>z{kEi7=Y?|9z()cfo_^(xB3A-Q0s`gO(9}eCQ>)~-Nd(?| zTTNx_#kcmNU|#A7#8q^u-T=o{-qr~yy}iwcp=H0LL7pq0hmxEgothqN>`A%or-P8wChN%na18#_B2+PWtmAUMh2#_O}{=HVpAh9{-~PExRC`4c>P0eL(1 zs<*o|JboTdQh^UR$$I;GT08p2PXS5n@4@E$PjHg6!xNK}gM&4PEx)ZRKZvbAMStrp z2@jV;>Q@3^w%Hc|JZD!=f3OKG1*x;!YVzg(f=NzIjrYwx)7o&a=sbyb@Nc?LKvY-` zNOu0pGS^nXwQcRI{|PQ+tZM93LPEkQC&njdruwFG4K1#u+@do!opB)hMuug6LXs3l zLK)K4)>*L=Ho`C5ThUsc-lBwroEe#%o1GXR`;K-bENhX<*6-b2Nm5z(Jd)&yTi$5@ zKzDaXEFeiT%}x(Cl%}^UFB>17m>n6y1Bk}A5-$Og*RyX`%l zzhML|3+zdMYeDLO5=nAuaCCZR2#_SnN2L!mvBk&Ua1x23*^{4;B*ViYCAGD56zw1q z^(gxBJ$0oBNzxTiw}(e3XAzJjb&Yr4GEC#EH+I4pQgkn_Py$I#dzFj~bv3p3J<%W; z&@r2_?z)1qIpvk(qkykCiAOI{Ii7Qif^E3+krgAuY7x33L>qa4Vo+3(joG}PACTeOpIWsG4f>f5R^ zi|3Rml2ZdS`0T`J_YuO@Jgx<{`0{(l2ua>tEd&w0i4Yb0Iy-tYOf?NP5QJoVWlEe9 zLK3bW>z`80P0pn)qkNWsf=b+Q>8(?UwEBMlBqOBb{kgMVQ(b=YHZp|8C(xu&bQxeI(`xJq?^WE)_ZXpnU(9{_+4ixl(vYDaY=8oa3*cxMa5N%gS zRe4Uz@P82`hg(MgIes>86=D0JpE0)l`m4vTE^>sV2q5ALyvd^pFl{@=qe)at4K)jl zHCSGfQvo=PfFL>72XMus2*%M`l)VL0-FM@jopU4rQGG&?92Z57c6W9451k=sSkUR% z-k$E-y!=rmg5+4wBp{&oMVQi_b=_tV7oNTT(Am3v9zk*zH>ziK^mNF3W~JH`Re1be zBXR(6of;sQBK%0BS-{aA>FIB}LO9+X{u#mW=wCPAI~OUZ{0M{*us$bb)l>Z)je~8A zU<)Tme9Kg8TTQ{g0FnS#JUrCd*3UOni|IXQLfH1>)t8R{3qTT3wBpAGdb>Nu-co2( zcs7|4G1}ak*Z2uQa(bYDsHeFle=GLOAV-^EaQcs%c23p*1(56xX&dYB@0_l*A*v8z zd&r^wj+W}8e*q+C!TtvOI_uwSE-M<|jcM-v^ZN5Q;lML$T_6C-r1;UEp1$7Es~Bbm zjzJU-)XVc)l>m|)I8A>7Q1StHK4k}N0dc2LKL6|1?e|W#^Z1WA>?n!o9BOarnF!J* zSp2w(fSsCXl~)uh@gq3^0XaQ3F$6QTwx^g;Pw^T||HAV-FW$3<0dru7Mer zg(_w3O4!&o+|W>vHH|LS9~Fn%nxsF}K)2vBrU%J{l*q8nfcw}ttEV%SoKY&VW zucuQCQhMcene7NX5=?MrunqoKKxaen*2N{wr#CGA&i=vk*Q|+8;F0hoYf%dhPMeO&#b#R1mNZu*0%Y$c?l*o}|9nJL}jq<8gVSZatRhqoGp*g2C8`f#! zibHdfYZ^vAAxCEDCm>|f?$OIclFm8UPV;!Sv992MAxF-1wl&t)R+U#qmjU!&admci zS#e2rS$;`QNp@9QzAQB?tBBkHTis?6a-`ItdunoYY&ITNz>oh%#J1FT)>ottpnpLi z#5G})LPtwuYjblO%qVM0D;0Glfa5Ds6shMGjq#!G=GA9GDMrsOadEvpKiLF!fxRIUyJ^I6d8#&9?qM6-0Ny3gzb<~w+4kO&i zV0;zm5fDMEYHFHVTRJ=1+F=e4n1zjXHFZ_B)iu>6MI|MLx!JiT1sQqyMcIYwfcBJ} zA<6t7*vPQlQN8ZI&cXJ@*ut~63`{p`qOl^i3ZFx;kpP7YWf34DRyMS>wY0Ut+#mgE zk}GOS)d1?Ks0P@`(t@1q%-q~GfX*ud*vLFZu1Z!$v^2KmU)V^WzJC2qn490lR6ciI zjA2*tfySbgacGew;}JM4m*LYR-5s56ZSCz%?Hz3`t*wo9K(Dp2zPhHi8s@jNp4mSxi}AS9RYYYln`ErU?cq^`nvU+<^8c%>dYH2)CoGd<82j5FbvQD zba#QqWPd087Y;N4z!8J)24IO*)zr5(wl>MDK?!B$b+d1m^!A^}h%)e%}B6qs%8ZLJLr z^^jPb7PhrkLtmq*9zgoa3o5{piVMr@vKj#JDl@aFAhWQj3{WGp)blg50e3SeIxejd z>c2765AE};7#M2RYU*O?n{CP#Xkn{cMgVAEt^|#oYOihX?CFHrEDWcyzOKBix}vlq zD<6;=ld@B@3RBXu0raw{*zKf8SVLZZMn-0GYEfA+o~4mll%E4YpV`?3=^@gRaV2bI zy0oXOtyrt1`k3+3r|hEyl|a0`DkEzm4v)q+k2crJJ9~P&;ZIe0ZB-cnodSMeW>H~z zRbfp=aYcDUX-P&-PDwaCNVM(Z-3PEL92lEhl!a$%fWyoJIKK=<3MDl+nVkR-ymZA( zRNkPxT;8mm_1(t9KGC1kX}rmn%GAt>ImJ9=TWxJgYD!LNUP)GR zcB~*NFeEB4`Bp->Ai*i%y)amwxdx-JJ9Jf=?>6;7FYVea*FP09091kW-i& zBa7vSG!&Ngr*@Q-DbmVPDm$}AGSeSA++Z!yIVp;X&rXr@GGqz)Rr*zxW!YH;MY-v@ z1=*>IiOKP4!4Yz3E7E6J*}c8Z^$iJ{mku0}CLU7NOB-n{i%*=HRU$^tjzYfZXdmcr zuc@vnsj11&DUtccB+Dw>^5k(YF1LQV^XHXAN6sBSXPY6e_Y8aO^~)=dxRN4RrO!(Y zNzK(-|bTF8)ARXb=GEww)__{ zau5{S)z;V7RttcUb@_3LIVlD0@xHzf&s@8<`!ma}U!B=&wSLu#O-vi>m6|)(-}&49 z!GWKi2dC!b0YGV-%pftR0MH6EvLKRWXJseHC&$Od^Ap+-Vx&tIpys!>h_7j0zbyA# ziY;pxX|9M*{e&2~4_tq4w5y}18=y)DYKsahtFvMfipm=rlb`*xZ{6N+UOYX0@{jXn zz5luT>%|*cKHq$^b$PCoVNs zDCtM57Rg~FgMFuKThrHHUlN`UmF_%Z zWC#2QA^3ML?e!())kO&jS?PiH7e8C}i~YSn@7%c9QE=tzwF|=WTR&g^_2E?E4?kc0 z{+HIOTYvnzZ`GCs+SbO@uk2&0^VN%TB)-DL^0I zwYj_W;F@nV<63rO3>My6nGA@LP_NEIMm9Hq>|5KL%8M#1(xPG{Uaw9r`}~)y3HbXf z*Z#aJe0TBMpJzX~{(9-cF9BT-e!BR>@1>o$Pn|!1&THnJnH7VkV)$D^4l^$|4U9jz zu&}zOvN$&rLP}zMc(9Zk-P-9f+}cpz*zdSx<8{?mCl%V^f!^9&Nil+q+&|Uc*45S7 z-CC8MUsW6v=ym_=t>;c${`=0Kd9Aj$Zvy#WFJJxR*Gp%A{`Hr0|J*q9>)CIjJMSJp z_v82Xh6*2kd%zkV1|pyEW|n8Cr58#Cp_zb}3D%d9otc`J9L$$SWJaWpw>34irLAUe z_g5|7hGCNN=JI&yzmSoQOm?X@|%6*ZaCw~u~UZhb!Bz3o4@?%CVk{Nvuudw<=z zdIA31%`ZQn|K;a1KmGiFm^ zsRL7gBOD-KyB>Q*B4}>!tWGYMcXzk<0trhd6*N`A34xsKH}4)idh{%K<*L)~C&x|1 zc)fjfPhNHhLIUk*!YuM(c)SGz-Tea{715_~>o?JYGt(o_ojV!q;qT&O?Z)sscf!rV zQE9ito=zjuEJ>dC1q`w^!`jk;La?J-cr>N&oH7-IUCgZS<#qIw=W(Qcy>d8=1UNMG zTmU;Uee~6xp=Xk#bBrD+CLdAN9sK@mpqh)O$HJMSFC)VcrFhieduNbabl%Q+Gx>bf zwUEWkKwGoYO2``G3wN-%dWg~4H;38FL zcq#b2_U`(u5=BpUM`x#`RV-*0)s$yN)D8pw>*Si{nMlawDXL+=U)_@wL(&+Ei`@O~ z(fubco()PmhI#}Ej=Km{?<|;bqMEb zL^z_PA(m4ZR&>j<2j}rtHtR9iNto5=_^n)7TUBz2qOS`u#d5JoB<0rTM_&*;y zKK(`K=1G{XgYO=8SMq-T#YH}R@MQG$z4qQat@&pRHy@?4LeBemczXN#pE%*~>+S93 z?aA_Tb|DxM?cCgL$rLM>x7QgJjoi3AM*_u?PNP$aUKXYdy0w)Rb{l5pwo5`;vzVKg z*wESE-qRtINZ}|>ZBgFIoBekgTXwa)c2b`>IraI2VPVNQE>i2;li^n{pAEJ34e%3~ z8`ctn0t0=R-abBF-rl}Sf5c~*r?-~}%iZ0cjx)7!bhPl!8m;nbc$$1gzz;SjQ|LM zk-mynFdR`{BwmSp8y$Z7>Up1{zgHCIv2(4{rITLXUcNp)zGy>ye0{uqJv=?VJv`i< zTu6rIcGTnepIw9VHo13ZrN@j2zD*5l2nT%`7ZP6f#Uon%`hYv<;SK zvvmqa-CCxoZEVR;sBQ0W6T=Ctb^%XRmYH~du}bXkjA<$+6NZOIJK0_T@*?qL?;kyX z^Q>LoBj6^RtarZ}?T6kRy+2GvXo;7Px0k1kvu1Iklvi0(86P9=?Eo~q95e!PMb^ziea8166wGvv z#=W6|=9+IPF%rza&yQbzc+=O`C+SE$w32l3x;KmE<>l!$=Di(l0W=0W!rR-^-Ob(A z-hsSp`m9x3)^84xjj%bVjm+_8cykML0+B?f(J3?>jf%xv21goC#5mW>;Ve&fNJ&R; zA0TBFQh~UpFec@EI>MQav45gIIw&pdLy3`dzCV8ge!kvLp}hDI)+Y3NFw@;r$(rB+ zZSeN>9rIoSecKPJbH zcGDHJ-*wG4aj{oRy6qp285Q*T2_QR?a3j@$ir`nzChNCioL!SMiZ zyYP4rc#%1y|M4OhKy8ADuR5f?vQHzHdY+fVf`d<;aCc|1{&?sxSu77Pm=G`vJiR>J zAe7~9OT+6eR-ds}@6b9N0fs<{n@%({#aqBsAVWWp9NV#yOV%_q;?W5UQ#&OUg*hQ1 z4Lx9J06DXxU6^itCY6R+edocbMo&TYFXcElbMd$5FW%gd^auwA9Px4dt0#j_pAPVG zbBAtcjp4$haAl)piG|1u+WVJKdW z$oplt`>7l8dGQy5Pn|v$?B(hTv)>&W!WthGbXBqtSHxwhv%9@9ZrA!v2DT1cwbxjX zaVAEFhQ=ml1PdaGL>VI^6s#r9%EF9ldla*(w5KIEE&1FvDGKTD?Coi9ZFD}Kn|D?8 z=<#j!BFOdxSXV!?_~X-;qq2e4zEM|g^4V)4r_P=_6&&pC23xY5(j9Tz#$ZNnRCqYJ^ z2=Ib7xVtM|5%;ZbXcOSegXzI^b9Q#JCLG_s_6S{n>zY-|b&e9vpc|kW7G_4~`|-wP zXbKJMl+@V%`Pc2}ZE8matyQ<8E;^@)+j~1CBB@9sabMwG7+d#Dk%^I^6v-LNmye(I z_T6r}U$kL`kALK4W$>J!6M+FIPq?|bxx?3Zf4H-h9_v_4mbnKrbYv6uFy-*x zJy=~W-9rTYaeaM5V?#qrR?Ow=bi7@t0Q>0P?YkAHndU~5=jU|RMG{tQxmMHKCT*1o z1Y&{XT>Ika)DCXJe2%K>KOjlQTH;_hdW9|rZ z1KJHN4_9}ln;n^OWaIK9UoBENo^r)Cy!ze`( z>Vcn$rf`k49?)N|8?T!wBEA#>Ufjh%0g)U&Zx;t9a4=%!z zNPE_=ShHr8_TuHcjvqX7?09A5x!UY$#85L48G~Gz}=|vpm=$DX{Q)T#hwndtpXgd~_UU0ByqZcaH~U4;1Y!Yv<9< zfRY$+2Gpd$zQq{5Tg~!}d zDH_K~F8uTSW#`CX%YBOGPIqsQfU`a!Cj(CS2l$^*`s?|6!Ly^I;R+)AZ#$qB4)#YI%$lT}wD9&b1w!JF+g5aD!h&#hajlW>gD;{&E#^ckMrr=%pLXMGuhknp1aZuDG0;8WS6*mQeorU$~_9 z*sEu~&j(6`7gy4d*PjP_&pVz82t46`!q3mk7ZfRPSQ&1c$7ia$8`B+ai@l90(OqAA zy`eSbz>ZZ*mn~Z`chM?sE#0mAj~g0+MrB5#Drp!itd%vG8#Xq!*3^xdg9`p$2$Ifp ztOJ9OTU&p5+nVih1#kv3UM(r1Z5%PV>f6)7hcAS@^Lys{bL#mIhQnQgKwh5kLz{u_ zTIf7+9drBRzK-SUAm}7EYg|wH&*7pOKM)G1>|;l}@*u zVQFP!Z9~V~ni?Ne-y)YAqZx0cT$za5QeWk=amk+KqKx>2B(;S2Qb;i!LRP&U9emx- zDcGaFG044TT}9rH{r`uqypLSj=;7e*S(wo}k=}5LJ^$l@&bI>g)RGN)7 z+8R6Wd+*+gdrzrt?-9@;@oyGATFS4fD2b;mnPZm2&PckMh{USKl#IhC>0j!tKSSd-CS zadv^V?1oMlH+u@z-FC}beRKK=%YAEC=&s+0)tWVV`ZAqq%U13(G{&2P>IWOWr8P_# z8*6L2gFfBx_`wO=?>3{2(b(ZuRSUUr&Wq_*?E-p+T7E{TZ2EF3!Xy?d6WxcDblDW>=#@&yxd(8n;%d;*! zw{Fr|hTXVEXP$=o(iJmSVE34qn3`D-Eyy$qjn2S=eQ51qYfZO2XrZ!6*l-9Ikt&0k zTUwN#WHfcz7WYgzg&lKABkb1A$mo}q2(WcfjQ^{917!^7>5hX9+(IvJ56|=dPBt#i z&TdMkrklHqs}rnYCzmldrRxTFI8t?vvTf^ebGlEc)w*TC--^>KX z+%+Hozh%c!9K*|xN!+20)z#6`TCT0LYQ^fA6Lr=e#zEJRNMuU}&C<#i%doN}*<0Xg zhWqp}q@lPK5V@ReWqT$fn6hQrj7_>hRmCY8X-N|z!=s`jQoo{P%;gV99`!ZZYE9HT zarn2ol!PL9qV?k+Y?`dfDD<0#HdimA29%B3rH zRxDVmt)snSrN%7mW-uHq2qX%s2{3G7MOo84MHM9xCmDw^cEgb~V5sJR%f({9?(#Wv zH|`4O6hR_R5)!5!6@4{&80Aqiehj`G9Z1_U5n~hN!}9k9>%ha!$Is2tl4kGX&9t+! zq*1LXR^y*6blOi-OdS|!dnj>*|TBow!=p^E`$!6zu#isMC_qM26&t~fdV5& zg(*#?BMgMD4Z}^^|BvdDhVu23Afmh{5WjsD)PB)nYz}4@q8yP_%^Tq{k=M>;L97s^ zX<7Y#_M%TzWVj0x5bYP>#zc(@5XJ7k0e-fYPA;|#Gd$hWkz#8}wINzslP$8)J4WbRVZHqGffO$<<~RBF?cB>hdxW~lF{97!zB0Zc%0ie_?nWW=>IiLd{*$@u5fhn@WBO>1WOd3v~l z*$eXsc1$N17e_ZQM=LuA2dX7}xFwlFA`wXDbcYi`mL}#lKDdqRb{ssoL3jPG{kvB$ z)ukCMn4+aLo{qy`uf^evC^)hug-D@ct?Y05c;iV2*Dk~uiClDG?@}Y3AsyeNJ!2+R zF3&B@P07wmPM(+=6&`gx^x7koAZ7LK-e9M|PaCs@?pg|Zr-tfm+s2-JM}g$IBdIW#(aG@Lvwu2>m2J7 z+yrabHDE)DK7 zdSwu8(TvZd!}1o=49q_#?cMy`eZ0n)hAdY*S9d3SJ14&jC%uBg&z}kmx^m`5+?C6z zXG~4(9QJQLM6fa3sIz{%-Ucn5HQP2UKDc}C>@BVo6GN+!a*{FNQAdnsZjRw>6^+R|<5+>=)+;7$p&pB?%1X=5j*Uy5lo%5k6BBu9@fZBn0r|?woB{MDUiG|f@{!M&*(!}^1;Wwiq{P~=J+w^2a%rjKQoc{3s{Vfk4 zADG?_p(0shu&uK_-QJZ@?k8Fstlxf&LEN--`TAX(w6u?q z_bi^efOv{_-0ZmjiV5`W6RLApKv%F~;*|;tB1Y zq2$wba7;WWJ2f#)Gd?ovW>ol<7Ic22839)B9uKtE=uN|9JrgE+_<_TjNednr=xdQ# zIye%D)-(cxMzQy>+e31));F?orR>;#h)&zPey6#W(TYVn8@FM%QH_?)TxfjJ(Fjj5 zvIvvDYR@ILiY%O}Jg5XL0mLSSx_isCSqUjVN7N=wn;LZ^AUXcjI@g zA2`BrCLS`gaXhwlhY{U;^M?Ht+CR${V|VU5zIV}_o7W9;6TtsAC^tBLR zWS}50YvtQVa!H!Kg&M^Z6lipdv**icc;~)ohMf%!^?90-VF2v$yY(HNjE83^4BPRP+EMB7LdCJU!1pY}f$%J5F6cS>JC#Q6O{E59=737GgVP|11 z3X-$7&%(|*Rd*^XHPg~lPQ1}j2k^GsoUDw5N%4_aZ$*V&C;@^cv}x?^eMMc7(Yz^6 zCp|rV{JnkLe7?k!qaSp!E;ul#pp=pxiecxTH4dnt}4n>Xm05_hiJd5mDN zdaM2pt%b`rntNE9Qz&SYz>Q5Kl5ivv)!5dv7(4RkQ_~gvB9*xjSq*g-t53!sEMjJ$+sY zVs8QsPX;y2kia059q2oEk{wL<9AQ`;T(ecr!eGOi{bcgKox8LatlE0qnr=p-C`kwz zAx)u>DHI|ZeA_rPytZS?;IHR4Q!x7Z$@fa4aC*$q!kd*j%&6bK7kQ2Bl9IwaWi}>h zQo@aMQ4yi%*dPu@k)S{+*UMpZWdAYmR-x+8NCp(UYQK`mCb3G#7kj5~x zay`27kd3YW4jhBLU3c42lLPAv7?uauW0!B*dz@lPvLH~%;L0O|t^~bB0nZI=za%VC z&pRgdn97VZDNWyRH=p-re@M-#iFbI?XI0Ty1Ie-gFw4tLhK1*SEi&{})vs}qrO}^v zPkG{U!X%89vg?K?y6o(j=Q6uq)|?(LrqOW*;5VcgnNY|?24l}=oHb$RZXDTY&FUiz zI*w|*ZSDGv{~R_Z(a@GCNz?we3kH!wh94=ZSPIGP7}WSO&IbJ68&P@Qy$7+ym1oKj z-|LN>3U+xRKuACwXr{!TycB-kUx?x?(K-I^fk;qEovvb#66EUb<>Gk$v~$4o;f_!D zkqm|n+0Y1-Xo4BTm1s;i-Mr0!WURZ-#pd8Tf|nZ^)RZmzju_*KRB-!(4Fa|z=(p%Z zr-1|@6Y)ecmPWSUuZhvRoGbk^_5zAQert~}PrCU-VVctjS-NHHynM+22U!qz?Rt2q zp9GZ!+G8J|G}SbEZdBRk@8rXxd(^+a!YF>_>UBz-b^{hx}0lB<2lfQ-(}%!G-t2@#QDS5I~R6;AISaq?=Sa1(Wdd|jAV zT0a(hJ7s^4@?tPtY#i+E7(|?rDTF~R?M|J(Np(8 z)&;soMj8;KZ-j(hyLNq?VQu*7PFZSmo*`z5ldo^#%WuUVu69vFA445o?42APZ5fs% zQyh*+G$vB$Zm!nez7DQdcmw^z;E5wUN5(U)Xe0|*^<-$zZ}K$MNld0e@W9MU`t~O_ z!_8{$MEkTykX+y0So0FO+t{Y~^w~YCrUBCBA(I^vVYAcYCdNhiU%hrN@*}Da9Q}Hy zG^?r66f@O4eh9f2VejVY#EiHKE^`-f)!SHETawL8EU1OFEfI^(Nz$^5ca|6UDeb|) zcX4rcaDaKlpb{?Z~QD6&DsU(sqNPRld)qde}%o6(>189=o z=X>{l{~qptKK3W_QZ0w0tkJ9lIav&th~zlUgqV|IVJAx=;4rR&{}@u_r}D~osVuU! z_wcm!JZpzKLzwO^PEL-twh(QmTM$gC$IQ)42v zcDTQb9=Zt~IV#D!&;w^m^9nfza^bwM%V(iI)q1KfIk6)4+9^i#ZhR<>=R!>*fw!#bi1w9S=F!GU#*?x!`_j z2;uN?14AQ2qvN>ahWf`$K?a$gx?7yrH*_xScaS+6lcdo=WP>=OQgJbFABPedCx}o5 zYS|gyH^AAAEku;Rek0G%-)N{}mvbP49zY!c?*h{Igw&|>*F!EnM$M)<%IAaS@zvtg zHJH^dPUpIQ#Dj}<%oTB3;OOk=U~OehN9F9Xx)_dQX_h2}=8 ziptS1U$0v;AqWIt;8Fx1tF;xKcycUcyMe!X%`XO#V1Y)e%^*By3bDC6ViOayxVN~o zNFrEspnNFl)2W^|#uN}qRzAM#FcYZiX(-|E8#1rgKc%Lks05%E91a`E1;xODOiG$~ zBj`%h1&EiSEX)PZrOD2PiW~DWI~sGWT-@xP-5eoG>S(XDJqRZy@Lo^aBU0>)o=eFz zB4~yLGjmf@17m^-t^R|bseak0k!|q>3ov3~Es=;pqgl2@GRe{&H(!0yo;Z~|!2g*4 zDmuEZf?dikE3d4oV51O)ob=R`WR2+4*Q2jJMmdz0p9gB3F3TGAF;liVvzYX-{s>z) zaL9lI*_y$i=~E*{AY5u{Vg%;A{^{rar5B#I;7L?-P<5a;C}eZ1 zr@tz#j2YGjz!p1pk&gi&=YqQtz+Nf=+(dbKWkp$WE`YQ$v(nQNH6ky@ho$^L+pyr* zOF=Nbsv{cmU5@+PhkyEd&fXE7o=V0+D@)3S^B$fu#HZ;kY(yji!NLrW#~B*q%wUHI zZu|C9#591WSz6L?aH4=tGQ9BYS1OV8&n(pmyCeB;(WJINXoA7xfJ^0-?BYta9YD}6 z1iC>c81+es>XFxCuGXO}OiSgbzI20&vgQ*LFiR-zcYh?VNRE0|lD!6d~Q85)}r2xi9g%jezogDr@3_>aN2U^`_{aS^XSgl_@f?e6e~S6?)q zd;rk~r{^^v2DwARS8+*InX+nXWd-m-^Ru$D)6!$3)o)yhxHf_^DCvKmR662vTG;@e z+?9u1q1f3|EUoRVL5fp}raqB(UyR)hA9FDQBi`KH%pBtACPolGh7mHun;p4w?~DnF zN@9rKxZ&wmG-Gn~{aaHo8e77IcNK-$oU+G|l{xkUq{z@2R&E6wSZk$h0KLHI08}GA zFDE%QK0*Cf=(YSm<84uX=#17o(b5eiGv;tO5EHSs^rtcy6dI_x=En`l!9ixVon&(& z=$UYs0U`i+G?Wb+4~Th_D5cPtL?;{OB4tD~8j(mbbzFwQ>9AvVx0;V7c7? zg7jQuWmZ)JbuJHO5CIgVxFjzvE;|jddkJbc!$W(}Ai>7p_lp?EQrcRqr(kpsyE@xi zS3jqt8!nX$4jlqxx z)=BH3V9fCw4dOHk&J0U&y?nFx$FKXsM9+}Q1_03jJ+`E*1eyUGPiAUTYI<@?a=co6 zRKh!yh`HfI^R3Lq;z!%B%)VCaCia9Dq(OF_{j#ru>##mEu zfq{D&g51SO0S-21lhAKcM-$USYbRh9xMUQ?dK+)udl+kOVQCOh({Rfg=aXMq16&eV zy#OyN1F#h!j*}CCp_P`DsG1liMWL9~vAgw7JDf!QWl&;4*YL`R2hOnBn-d@kLoqBv zPT}Av0n7^cfvG7TCW#Rahn{p8x9ChyeSPQx>(`iG_a_Cn5rDocg9?k!8|yA!zF`w~ z``&$edmXKv_6OtwNTq~bRKTt%$_BDlVOn}dR%%)yuo;t+k(;XEc|yUMTR*nvo2@t{ zxRX5#X}Xx;#7sPRnG@%%w`9u9Im@-MEC12ifOod?iz%tBuPg#oX%V{$IFZ2U1GY?2 z22j2-(o+)E!=R-3cta@4=e;p&SBLa=hXL!G7)Y_961+c4DFh4St4QHt3%ucBvLQr= zV5-9Cz@CT4!xS+$rBXnvj7GX?1S;L!z~L}dK)}TnUnc1+oUJx>&YY>(`Ab%rdl65h zmjTcX=4WA1Q5o#L?6T6LydrjfN^W*qQgX^ImE`v*CzJg1W%Y^48*V8^!*)PEa+^1Ll_F25xQcGO-#&9K~ZzRNg{$*#PQ*WYb0wY{K^@a*;`$b z{28%Q>)Af9AgnF58!|E(uG-r<1 z!bO`8VfPzEQRWidn1MC~50Jw% zcGzFJ73#is)v_f^RxF!6ZMOEtUE8t8&K1@Gu8p0So(G8K63}}}@(Tgn1QMh;CmG0o z@yRz+KBBNpk`h6_bvK?^xzIAZV=#3yB+E><^9f8CgApMRUEV721anjO4?}b!!GQH* zgn+}Dm|p)Zy>cyzd1w_tYxmn#)*xh4`xaCGpt zh#o65G&eNx{muhZ5a;~liyO(s$K@91oF{qXR1K8{hrL76@}hi>Zrr5e+L}tXvSevtL0%yUDt38kNlpo;qyR9_CEy6oOp3i(4m;e<&`^!C7z**pVCYyHA?EEW{6lVu-`UON_!|)08dh__=jgZTy@w;YD177ZO6Sp%d z?3|0>dfB#l!`hY0u$#7R+qu>1dU-XriUWK%7<5z{2hbCctcnXOD^Q$OX<>S5T3S+E zF=QeAhs*prq9{uM+wMkj!$7RhVJM=ES)e(0g>R|9QFvVVh5Hq!lW&GZ=ERvCJr2zK z8oc0FLSoeLDJdSRQ}+dyc1@JcI@A|cf&qAyW@wpYMVyX0&A~|qr)=}K&1juE>IR>_JR4ImY$Gwvk92n$qf$1F^sD#9W6cs7Sq#R2|V zd6h;vh?bIaW!VzAJ3vW6@D~?XloXVe6=Y@SrYC1ThR#KA+zko@4*B-t{_S4iMwFKJ z{d)hXzAd@*R#jGKR7H4bOvshMm`hQakx2!qHLZ7Fqac`{tv6Ztts5PKEsTzAIz*sc zEUYcB02UqS$>mkmYUQOx#bc$5Q5^u-++akYWU!pV(yZ+4yp*&dC0IP;{R^p9$}dkw zAUCc{EELG!K2m=F`S@Aq{RXL6P+Y61ma!Z7oe$r<`G)c`m;HKt%h_=Erfr+{8W`Am zho#kVIkmO*mBl6b!160A*DeP&8H9RCd0BpbX&H)PMfsV)M$FF2&PeWp$3%IV?a0ir z_xIsYC_p;p@)kM&?!&*d%(paShD{V>7pbb3*xP*77<2bjY0 zvfRQ7c139!QnrK*K(ta=umI*_!!A;g51kAYMj%2Y@&2P_{(dzG2kqKBWs;7b9)SW* zyp8@x%Uq=dTIPqRU!Dv~I3;2BHjX}5^Gd7ub&d6$nyMNOr@D$$QBRNlc?sRnW#QZjyNH#PuIQZ=D z`_YF(GD&?&QFd--a{Toh$;IVdK}&06U0roqWo<((&=6s^R#m_~D=OjH!1gOb+53RO z1IbVX6)Fk}a)6PTT=oeFUC@bg#Nhk={+_OG8E_XHg>4dmp@@5hg66tnPC-pAaPC^l zD)Vznvx+J!T7+DYw1vk9+F(757t~0t<&?5(fQblCRmoAS01ZG{xBzr$RD}l6V*yBj zd;qScO z0D>jl1fZON$V18(mK6aZ6HvK;3@k-?ohZ{UD=D|{4|*plqW-i`E|oyeV8?W^Kp>Y$ z0XEtq5Z078Df!y~m3zST_MFY@An*aa__(!n5Yb&ejY8G<9(*}5R=r>r*Wgy5(fn}GL z(f2PU6Hy*RKHY=If&LPSAq_zw63O6Gc;fon7LkC*ZRT+so474}ZUfAKMj%TzG&Xbj z%}upcRdw~XkYEb;s;()+lq$>S!JY)L#cH+|t1HUOMVYtoSTN)2AN@~G=HA!sT!DZm;6s7!7H)H0Z9T6JHYsR2JO&TWD?*kV zk0)$_1>3^qHPr!;5*_vmaN7deP_3q-yb39w4TU`5F+lbK*D=2UaD)O#+C(v&*x!%D z!baeELNj@QT&*c+Ze$naR@B!ta$&6q_`n!#ZsGl@n*`fk1uV^q%0HY*Wfe8REFJ&o zS+F*tgV_0?IF!IgXNbQ43(5R>M+m*r49#vrmvnVq1Dw+;sIGw-)d*8b0KaLdtK`&h zssKsJhO8ZcWU_%g3=#k~Vt9s$Aa7uW6jdsVkwOiWIxGe%4GPIz{B@wVt_fYmjddXF zD}Z;}Se#qhR9#(PrEJjV^5N&4YGCD}L`rrgFb_eSL_ZzAuSB(*nW%z=PEi2x=H{lR zafbhcWFp@>>dIl`QR6unWHX8(EB}Z8X z+CjM*m{cV*;irH}M0uI{*?FbX7ymLck+B2FXCQl4*1&EIJj{9!tqo1(X~lK$ycHan z_rOrC;XrFkD@)Lt7BI$DaC=x;Y)}Y5pieJF-*eD#YFHDL_`iG*k{&7qhDY z4q90OoK#L#E$~c1tZ|^lfM^AlXt}aGSJMluR1&!1XU$Ois#K~YY2 zS;xn}m`uIj4_jaaVALwhK@BbE)Yezm03x@xs;03SWHeg02ymC6wG`*(W)}m`vk0`t zBG?$9jgxcpfq0o;lvUpO3FTx0jB@O2S4jcrIe^3jr5^nEz{jixLM^8r=teNc>=GcQ z1AG~9o0(vBM?l5poNuH zH5C9|1=uP|<1ENUVVh8t1H4p#B+f-$BSn)6vePn4g!g}rQ!*ie_s`p|GT`E)1rwlo zFfU4rIkiBs1-%8ehX5l5npkRP9?(U>yAJ`{0QP#(Qn9M(KN7_ouQghM@5&&YG zl#!K~k_vB`2`OpusX0ZBLgDTAAHZAo7n6xPm;sXcY*gOg(!_x*y^OS+#Eg{8{H&_7 zdO`dBFJJ!;Nak;3&W}&;UpyG@eQA(NoRB#aql3X>){YZ0cLDJdZcHrC;j7|2qg@dYD5%+eB%Y2jDyO9sNQno4bJwsShs;phnU# zb{KnLWO@Nnl7;cb_+bKpka-TsnCIbj>3mnb07L4 zqEAc!LM9$w#?TK3q5uBDY{6^gw_ziWh zH^HZULgxSe@#fJ$Z>OT8y}hHo12XvKA`w?CohoS(@`X~lqQB?)`|l_&^D8nz`Rl{8 z!S?ns`E;2`!LO0GD7e+N&3vI`1|O6aKChW4l8Ac-o_+tRgd3pT%kPNR*pK%BsA*G3 zh5U}jMyMzd6@Bv}Ld?3*dWp*WlnJs2tVR4fR5ayyMOj=wg(3373C* z&?}b-B(l2H#OqOs5uS86-!rkG>~Kd%GXtm_7a*AVvp3pbjL0r61qHQ<&yy+Ix*h@H zP>E720h#&jS#Nv0RM1>snHU~+EB4Z*8(I93vCqGeuYk<_`c{^@zz(X3EZ*mtm|s}N z0Ue{6FA_^Td!GG9k(mfG_t&et9blHW)Yj%CCKaZ}o(-!X`G_(D0bG>198SSc-tKZU zA+M^IQ{BXCfnMWxKK~;IvLvEh2Bl_icM3r%t;|d=V6zjwtqn@PgQSFA6aZczj#bBy zSBv6}rmI0QI;~^=@eo_7{_%eCwY4gmni{H@$%n3h?OR$|*CG~*c(RW6$7AEDOXX+m zXt!M0z{yR?sP4Ysc;cw;^5et!-ND7+HBwi{%(YF+ zC@u#&zd$GfbyNlbJ{j7m_aj(fJk)baGfSk8zmIxuU9)V-;rX*CEuS|Jqp?J5<(j2B z8@J3^IeU-RF&b;<;u#nXjQUFF*aA*VGoRlq0QA4K_4a!i3c4Koc&7*3*3ev1RN6B9 zD|Lu)2gdQd?6&b z)>gI1x^MqzMXte`K$P$9cC=%g*@X!?Vw9Zu_~h>87>#KdlAD4QR}>Ar~&54hcAW&ezW`;_8*yr7>Zree4+~n@x^RU+Zu_xw=s# zmC1VLbpU)9w*dug{1ZRi?d#@d&Mhb|6GAu~8I$h8sB5h|WKLl)FDg$@^E-brEU~1P zoxuS`yJ%T*?2V`^{=OD^$2J)=++!>2`H<7w)z;ilRwWcHYinjNE>6t%9dIs8f_0?KsB@Mv%9OLLsUbg8d+0MiN#D$RP+M#>j?!X8wG9O$H|#LZuj;oow*(#p4s~o zC1+0j*y6h>sI-=+luT~zlJ3Q*QmUHdAKQ@|XuYVhXFYw8tK5;m)B!LhQn^>l$I0`; zjhLjmXMfq5&*FA4N}IT_YNdTrU}x@a;0xaXi!uf}W*YLYr>DP_-&hZ7tw!GZ zP1Rg$$n*)n6;TbYPq-HNnNI>4#XuTTbPU}yf^*udd2RgBzx>S4cK|3X>?(CwaOnG| zE0`(M^=OwPW25U(^yYK8bk4&d=Ze~zMn(7CxS z)w)GU(tOQ{TPcB;(&DQ=K8Ah<4EzYov#hbcTGahA2x{?ROa@y8L(t;5aX~%fsiM2D zuk%Ih+O;7_-4a#Z2`1-*V$#@XRUh=?hqmXSR7Z=n{}lo1=wTfD+5`j8=2!&k@%$X< z>g($slpof%zTbBogZ*cc$LYxQ9N;Dc4-*bID3Lx=EY$fBwGHOahcnljSGwAG_r_V8 zWA}Uddi%Ox1gHgm$k+wzwB zr{mW?@9ZAx>wli0vgAT5OJni|QbZ(@tD^XYLNynTA^prov9wjvH)xGf(VUKP?(b@7 zdXJ2CqO3|lO0~E44)s41tyX8WT%3wou+jZup=wUc7Zj|ya7=mYOoy~pEbSL=S5=*= zHZ5g9B$NP({O`rTd&G*{!=oPqFk1@;HefVYJ9|YHsFglL#>Uy2KbV;cg+$Oc>_1g~ zx+-SD-P=;(ziiD{ZJqt#7tLRYG4DSM1(^?cozE-4^rF~Fc+{>Ft*sp*K|gmHMstpu zig8~TzizY*C04?~f|@rt_+W4cW?Ce74Mu&PU0_yz6Xx6BOTS-F>Fj71wT(tk*PK65 zMKflkwW$f zDrTvmM^L5sqijccl}hA8*X_}fyF-0@RrUJw7h`7aX9nb?iebaMH%~F z9d}w5Pt}~LsyZvPOHxre4%ti@7ox3w_eO?aR4l;k@1dxwE;!)gm6p?wD2G8+Rw@@F z8RvS0Qfc>ncNGn^;5nhEmtQOar|o#VKex*VNAHggIcdyo;(%_y+RXfVCJ&gf=+%oM z`0ygI4jhxML)=9wP|z7OIjxgllY8f1(B@r!_wfDEr(rWNR&PmaD$|ab1SBNGW`tf0 zU7}12>k>$W9S^Tyw05YfV>WdPYT4BvP;MlmT#URIOZ$fJK4@Kw(H7;+#c1l;Q$nMf z|HExAeCo-Q@EiG^{52ZdP~>2%yASyd8&*0TS3|yc2zv&G?>!E{s6@S{sHiS- zF!Q;P1+g&H1_$0I1Tf;S-&RPtts@SYb#pOOFJSF7&( zn7a@&@&e5HZt&Rkp~TFEKRQGmz1_Ea z7#Q7(-UBKc%SFav4;{! z-j{ag&Yl?l@!V7h{F+;zjUKO!Hr{i+0bH@5N&Yl@hMM{WHI*qzKriCnfl$ymar2!* z-r35Nx7lFK-!>k>OxjE!_=YH;c;*<~96_J^OG-trOvvr)*BP(dj@dE{6|=-&#sC$X z0ch0$v0TP&>5iT^wf?=sB8-+Eo_RhUL>Kz#ur2>Vc!^zdaNa)&QCC%;qK=uAGThd| z9YKkknJ}!cT166mi=<{f#^qzybQO)AhSXD`x1k2^-=2GXi{AyXqerdUsuR>;P4DRf zmS8&wgz>At-4-?rVLG0gw66aHR9s(aWXcRIf~kUDjo!Q@rAr`?bv|&0Xs|A@Xd`+d zFacpOxI7CM{=;?=R|H$lHr1<0vWCiH6ACpT`%IB$A7&fNTdr%lqtm9!VF)Xe#2t*Wuk)86ZH}Dv_yTe)hXwYD_!5I_DKLkyl2+`|4b~jd3*Na4H8&`HeB0)y6zn$l)Ti^cWZH}U*FtU)B z&@b!jXn%TZlFCF96yvnNBa;hJY^@j`dg;&p=F&zUSCJX`PvXlmUs_ObYItaD`N-|Z zPv5=$4H`JO*}%|wy&$5gue+yXbO4Snt+$?qS;X&_$b=Bx9j9(S71VLWLW#IKT{OsV ztM36UU~?-+BTJH|&Vzg{Rreda*49O*Reeg>Gz&E$T zg!uNf7rnBrP0<0kKe+J!Qo5QCFQL|kE88{AqI8lV(t@S4E~aT~~+zeB=QtA{0<7>)4+fz3I{~ICRmx@pEK(+I;fv+1;O5}*g}gETjAp4^ z$Q8Cqg$+W5Ovsl`YZJjF1x|&iz9hf&3r*K z6j+=k6Y%*`9z0;HsG_p@9%zo=V3Z~xFM|q&GX6~NK-8q^Yh>kfF{|4~+PM`&;}FiT z!%{_8S2v(Mr80OFK})?r*dnNIs^-+O!A;NO)Hm{K8@S>tMiDs!B5`9wQ+1uZLq1a= zSfPAe@cJtUqu1q^&(r zCZ$y%;Wmo}ycT7hRtvX|&lAf&%Ed&UoUP$Nq-R$9C2cIF{>F05W`OTDuz{J{f;1uPe?F26+Xn`E zI^?|OmKJ_Z2?xr_$t9hA%>#|it(82su)3n9R@SPJr)U9)Q`I>;?L>GPRMDF)6UrrU zD+L7eAf_j6N^E-i1Nw5}udGaQO<9X#RugW!NtST0x=Q$nf?vt|@gIrvZNH?w_jZ4K zXJ?y?C**Rf8U-z)+M=3*YlYFtIkBbW{Ir35x{x9iH#bSjW;hy>YDI<HT|mM$G^?kx%mG~Z!qY=&K}zvd{p?nZm? zE$6GIp4UsIicYyiT$58Po~P(;lga>A%agRiB(ATkZ>h*H1V;>b02(esM+js!{xh9e zi9I26G4w}$t@Q;Dpr%JN+#RC2zn%F71ivP!MwAVt#=S8>vSh; zAHwZjuyGxB`?47`R!!Wo$j0)FjqXubNV))7EUGM>Ujt&P9o>OJBno8$2+}ukvzy?o zuI4Yla*-5Vd#Nrn{JoxVwqTYD?{!Hlxqp;nC=wD;9)Y55cY6DKx_f$V3+kI>5LT*? zNZNWUob|BtHy;WNCR2P}?|$$6m4^aG^O6#}@Ih5Qh~H zC`2&vh2VJ;b9pUdQFB%fu;G;m`1Hp$SOugph>Lo1kFB7EusEioGl9*cC2K1ilv!yWzooVUDJ`=@>-TQlUVqec*bn{>-YPVvRvbCHe|ynU29t9xJo_7fXl^~&x)W13 zyYhm$6TTd_JW!)ZiHeej`UQD~@_hs$@ex3t@{;(70ky^R;0Isa&2#t0L)IcL*Gs?; z-CHzf5Fjz%wJzAVV}E;1(c0YyTaeSXr9q3Q54Y5N9@z&boaa8|8(&TJ|-;3&jB0u&t&vfuB>~m}B;--OW?u22tN^JKDOZeEU-dn)5+x zWAmN^4V$!kw`6-y9yZlZl9C=7Dw9P-L`Ox1het+*%R)lEeO%alvA>_lRVehipDEh5 ztEsTshk#XjNkr~JjvR@%#Dj188};tzZtLo|>}@DbtKEMPehxN9?W*6op|adlRMWid z*YUd^iw6uGByHK(T32$VmTsfxJvdn3-qyBzgLcpQc+Rk|7s_H+hf8H)5n*An$kkC1 zvdGBru+Y$uV6ni-#oJfHU0ri!TkxLSn&kT3k$g`NcYrmDT|IrhT}35braQkeH2Bi3 zWoPZ49ZE%AdmE6&8yW~oPkBWqKT$LM+aUVT=hWb-dm8pNmN&u>Y(y)3e79NK+}gTr z1DvdIr%}T=N%3JaSy-4ZTo?9pctki6hD;`v$%2D`k}Gkuak_j$;ClE@Q<=bt4g3fo zNC0g~&CCUH5DOWfX|^ zSzmO6Jbrcv(G;A+BYRp89oV*UNA1RJ+hy}5u`x2jfowDsAtDSC2@R1+Lqo$OqyZw{ z3R}Po)a1D5+4)4%@>R}w&XB-1iiHAE#JTni4^x47`g@eY%-V*{+jo{_Z`^+v9=LX2 zEAl#TERzR+N+mu6kowpGJNGp0DrxN@=%8N%L;vEwwuAdOZ^U4voHv|{ebcBrJOZL% zq|rZ27LH!gD;*Xl3lO``9zV}=nfuBecO&`5$9*{hzAMjNQlW@k4 znzCSlg}p=+=eNp<>*5SBG#=mGQztT#cnRISOykuj=`E8CK8)Deuzh1$dU8GR>5m>l z6af6{;>1|>Lyo~m1qX~e8cQkx&3ObC;k)O@5qqrPx^MRh<(Q9FrN#w?qW%bQ0DBM~ z5ea1o>y`Z|4GoqC2mAO31Pd)j{xZR0zLll3-6|KJ6UR*~O965CO@bMETIx3w5(w9?TZ?50d ze^34f?1v+KknK)gZ7nU^*6rSM=#cGrSQFm%Om(j1UScmy;8P4XpsB{7EYWLSSeD!g7ckgRAP{I+xc#171&l7m@`8}>f0IZ7sDe@GFeZ(SDfyj^V z=IOhb`Y35{Jsx_9N@zw(goDUlc=%wGXiBC!xMW}ZUZY|?Lg#VhMyBcWjr$un?yft~ z>G;Lsz$lp%rco9y4UxiI2mv2bm}*@(9X3)HN`w;}6yU|-TFzeL#$P&n=5!lR5d)_M zh&*7Bc>)nl3`E7DfZYyBsk>11xq;)h`i-qf!G zD<;)=Bm`ht7%f`1Y~Q-;N#y7A0)bBny9frtLV|*IAx1&c&=7RkQ4xAW0Tm4l3UGIE zUT(h9kH2`v^eNLE0N6+%&s;s+Iquf(T!=*EX(}$--SMdVRQ^=zmx{gHRO!*e;1-#~z1v;_buR7N*RXl>?#-um z^1g}7lF1^a7$?I+A&Y>(P+6!{7K%TN8R20O5#S;WPL-FvGkeig2X7m;?W}22C(N)H zaJc~ZSsB%QVN>1lI)71fo2e=_%EeX469$Z??Dy?dd_ld>S=-XSx1+sj|DnS{LuRVv z85QN22`5OMw9d5qIG@S~Sb*O0UK@3jG200h$4$A(KK8LeWcl!bU<8I2tDN za^Tv|n#B`aTQ8hFi#2(Sxf4K!IMy*2YQ$Xo$YU9&~Cd5U#6C42p_?wStw9%0dEz zgMy{fkYH&jqyVDX3d^CWy16&T(*<*iY=M59UPa$UGeu4 zdzlJ-e0)Vtfc#uw^i6(Co+)L3C#Zp_+}N?daZkuw!xIXTak++iM!+&ZdWx~T{y@!n z^@nC$F*lSK1S1uSv3oLx%fNuZ;E+)KM@Io0Xb}hnN+K4!ub8;d!_8*l^qJG=ux8G& zuyJ&-71o#V{iB? zYB3oaX}5UR^a<0ZPMc+6=>(|Aq^kPOciU0{8RqRv`+pxGj&9T4zPw}Dps2QD%v>2P zFWTFFpat73>g@)NOe#~Q=HwaFJR#~Z^yz^^buCTnFRtu2%vR_jmU=~n>SS+Yz<{li zl0G5T$$kY7kV2R=C=fyj@b&Ns;Y^;z7dtMqn9UkLe)5!QbLK9$<=R?{_=!FqZUCqk z`d`vCqc0t7YCN|2 zz}hcAjS6rRaeTd26AKj?fgTYO8Wa)~7^DmRYY=(`hEi#We?U-h0H5O@xNPcDZ-MQi z88fF${CzBIw)w32E1kIR4lXO*Tm?Em+L!kGKF~LS=i%b&Jknrx{pKkE_Z#lN2Z?Yn zw^%yI_~XDlO^!0JU*YzL3|!|3g!jh}>^at0(ja+ve)pw2?JW`~^a5C{FfxKeJ7J*E zTSIiAqhQB~%7zB{IJk!MW|%t%_&P3~$(lN8%;<5`XH1=Ig;9gx%?iB$$m`>0>gS8_ z2ym!=o@1$BHfg6}C25HL=0j~Q4Z9jLX8-kvIHZAB+?@Ud}CcQRkb^YM3Gv1HDqNfXBX_R~*e#>|@M1fVhxorv-Vj6S5|?=SK6 z&k{v?ar^(Wb%zHg;Rai)Tbr>LV!dS2+rK206v*ZIM#%qq9H5D75vNE3oGd6MT zucOCI_W>7nS=U=r%z{1pE`B?Z@*5N@!Qn7w$K-Wr4}XerXI0|x{I`uV^u?3Mi$N*pNk4(81>w-p8}!hsk+i^ZBgnKj{;pQlYRo3_9n z((x2YfbuQ&2@Ez3k^}_67WhdVI7Z*B-98`kF|?OdZK|y)v>!ftoE;b{%39q&NukbC z-XaXylX?5=4X5|k7tXUZT6Ls$i<-;lc}7V1_Ac&xZ-3|_psW3Sn7^P9m>#&Qfsrv> z^LdVLl6Z~pj2Uw*rcIg7VojPbW%jtA%q`gfo%a@d`S|;a#s0yj!Tv=5(Cju=1BY*} zo-@RNGO`XSuHC5iHveYguPzlOigHEVfP^$fc1{c6I|;NA-P_S{qJEpl4}TrXVGHb+ zb6vQu(qyqC+kxvI;Op<_=j#K@?&l9s=O9^#za$_qT*jVl$#w-aV+h}3`YiLQ6DF}H zO`1B@eDo*_D=re#AWMgDu)mLgkkm9VAlS>_)!BpZu!@?vC+D|;$cHNQj>%f%GVQl7 zCyw++BIV+OTsjG;xH;vI8O+RQ`}ei)tg?Ei|2SU>Qau1@)=4Dxb#+?ih&%(x|KW|i z3$SPsktag<0Ew^2+j`~#C%%_d>bjC=J7emM$rHzs?mlJK&*SDT=cC2EB!0fWetv<$ z!F0g)lCb72>oa5E%Fb=g903f^kN7;H(^7)|JaOFW4Hdbn0@Z+|#EhIY^+krCyL(SG z?o9aFz`#1d2f+ala$L9~fLhyH^E|}f04^5rJw3hQ7rKc95$Xz7%rRf$=q8rQL9 z{rGm~z{LL6Y|hN=_1NvMQ4UN=O3zBnJiuUhe%QJH$j&<9N7TEv+?4?wF(#G}$Lb_A zgpO8LzTRSAiHFcDK;$0~5*r^MC1NjIv}Bc&z{lIeed&yO^HwZojU7LB{Dd*ntd@-a z*?cKm=;`g_E%uT4Vss7gHw9$4&^I_mQK9*na;mpC{%P1(e+h7$J88m%F{Tr(mX+0N z@{9771Je_eQb9yw;dEk}qk!rRwhBJl%9%vkO# z5<9!kTl(=^@q6Zd_1l=?%cbn8Q-2vX{6~9p+YPnqf>MogKyrL)a$4NF8q&>r>8Hm} zHP>w%K7d+$`|`#t0UQIwRXn~Z2zTqjnP<6*&kG9-_YDdXxUyH;*t0o2Paj_&-pYkm zOP9=@KY!t(nd2r;7(Ld(Yw};rot^mtfyC3xFOakvX7_Zy-%0$@>l_vgGA^l|{^byA z$m}?m1rvYz@w?yMC-|0@DhrBKd4tpAQ<9TnDzO2J01Ddc=!Zv7ZCj`M^?S-A%1OZC z1LhED^gI{7huB>x_HyL{33jF9GGtJ4TnQ(a%Xi1fm&6<_qUd89&Bs zir3O##@N8q;qiHHLf8sGtV_InO?`!IF%NjR%cuAIa$V+}53tR|A=$%r=GdQ1m%7bM zFV4@^lql4Ll?jOefYShziQpOyy?eNQb9K}Q-@MBc2wlm zd;;KYm=yh){jLpWy@gpM*Gz%kqKTt^cCnwQEG|?Q6v}f4YEt7<5|dMr z_~smKdt-mYrdrNG>Qg?!1_vZ9GCcu*n#Z+qMLq>du)7xkMgg?!#`lo<2gisdUOdbB zwp_<~GiJ|OFlQ=j&KwKYSl2MiF~7U45s942ZJ@x9Z-R+$D!@>6v^6JAQ{}nbayoIwDt>mnjHEFtq#muSGXUv>D z$!XQZu~w^tL|lI723NZ(`rf{1cNlH4Dc@65e)SxECBUG6a*6X_-~Zs7c~voM6rK}? z&k-(+t5hiqi&K&ngYq(yvog|Bj`a2cdH&Jfu(o&%_6gV|t_$UQc>vkp#nQ@o=2AA> z)|TtdaSM;}kIl#oNtA~O1R|fs3v9VIb7xwzofnOpJl$gM)G3o^Sk9R_ezZkYjKGuU z_k?G);J~@OXS?`bo_=1m=zD7~x9Fmc5`$sYX%1fx{_+#++HhrM#N=PRd{*SG(`X7b z>8V)*6&dmJ>@3-yTKWRUT08p6p}m#0V9N8>&1>+&+}enzQo?yYKFyf&Z_C-C(N{%IUdpG$}yuR`{f3>csQ-Tyd$ab51Fhh zRp9L5;$iCL86fiIa%TKyz^+;&`RwhlzwoV$C@hVgZmHx4t=ouay)?Pm*?{g!mdn%Q zcfII%J?9VBSCtOyN9A1Dn(8hg(_BlO_cS*aZnUtoTe#51W~n_gNV)J9uz8Mfj9gdE znQO&yUNC*GwS(2snTCsUq>1o%f-Sy&cVUYs~bTDeTQzDiS2s3x$P>G8?(wB&G1kZdI5?(^fVb=9e( zexa;l?41CCFY@Ga4%YBSt*NnC>9~C1G9WE2v$nFfTe!&4)n>s;j+@o2xi-!=GiS_Q zm^T|K9NPR%UYwA*o<`R^IW6u_SGk38d= zRE@{&HAAj)$DO|m#kVmd7k}}alf$^31R~P1uDWw z?TI`LLZO>jBytvq)_i-e=dL!@<)?n{L{=R-8nDoO@!sS4bvvqj4%M%yTvvey>vDBU zDs50oYD8*MO7uECSAc0dcW`}4!6@pj#T@%kM6W)s0VnsBHtt>;vTpgDm5TtdxOmQD zU_Eo$vu1;%ne*-J=S?x6Z(}ua>JmqLi#ZFYjGbo1_45^aczcudP2SiZ59dbY2};l^ z|FSdBZ+U-2{Z?3YqkXN1UF_r5>U}$+)pShM=9*$WWDa5FXAa6t3|N!0X7zel1x8lA ze>4GG>37O-Ldw-f3=aVwoa)0ZTinLXYx7;W9N;(rahki*#&VV0k{OFQ4)doiwzV;z zK5OyP1yfh?o##!RI@w|c&&Ll!lEBR(t`?JX%|qmad?ErC2 zO}$9%wn29Fj9cY~bw#Ck^iW+;m^(OqjayV&T-as;>3M-(jywnF+Y77n##7Xa?$&sr z*vH4q&Q-j6=Y@QBTdw6wOQds{zjVm^nW>^ajH+b)|vbBXm*)|90@msPH|=98z* zShNZ$36P}$9Far~7?`}hbe{bs@TI&&rd}d9r?DSV<2CDV)6YBG_S|{6W$%7iaEUVhnu<%(&<)C z$g2iOHY>~JPL}hQE}k|M434*OV=tJ(3G{YaJe4)ma;1wqW~`C>N;Cl6fF*D=P>4qK z;CKj4C0@Y}Ce(X=HAj1O&#s^Udiv;*=9}NdWX*qeirln#de+>u7#{D`eUJse`Bt#9mmOLp#^Ybthny%`9hx6*m>S= zcAkkbP7As01?H?tQ|3GKy(AD4dLQ8k>r5ou2y&BoNj!zC{asD@{{H5JsPS3#c$DDw zxhuUiQq7i~r_*HRwRi%%xTL7KNS&8GI5jIFJ}xl|33f>Pp$qEH?9EE32pelOA|OEI zDr>x5AmSI@3UGI{cXdYo63)s+mdmUcTduVC_6c=eEKbapu8|3ytroGS&zd#g8=fG^ zH{u1TaQK>#8U8S_OxO~}UppLO%J&t|GJ0RM6${;uE*-f|cek8s(IUB~rW}~8z&OwV zctD*_r}U3l6BD0yiHtVp2<|RyPnE698ApBTEb+|0@~Ds}^(d=0w<)$m^atb(vBM$i@6Aai`ZMN^Q1*XVM09_nRy6B5{b~e_0AL1 zGO5=$hE{pku?_0+wX=`tE61*$dH5(WwE}p5RS=d&lUJn47?>LG9kV7n`#y0MKGR*> zmA<-a-E?ZmoaE#5sVD~zKcRPOoY31(=gC4S6N@}N(54a>URs0c#ptQjcPV?Zr?|WO-W^2Sx2`>+ zH~AD-6)B7GjDAJ2T2rXW9+VN|lN2AC*Nv6B^YqufbXSu+GQWsBkP<$>Q|RmEi(t_Q zzMTYlM!Y?H1rvELTt_}ITO*=;#jf5wPH1REc1D&m&R^{AZ12J;Y>+r0?VlIcss!kO z9*ok9vC8cwv1gW1#qrn&+)MX7 zde*D!x^rLGBaf;msjRN50Tc%}W<*&GLsJ;$EyV9&+UiKFk4in61p!egIHoybZK3Cne!Lp;2^UGi?8k7oM<+x!F#5oX&hn9vDn7vt$X^g*vppnQLG$ zsq21}gP)%mGdh?n!T<$JC*aDu{eH0uv|9fZsacSMip%E%I+iDJu|K|hiJfg$*U|`D zgH=#KsH3@f5?4E{dbxRqtsY}YnfJ@U=2AR6bTTBnyi@}uj#4n9DyS$gD##-+n||Rb z(QPDg&MMu>wISv?jS=r-jyKO?Y3qyE)M;6ONTQ!k-`xl-#z%lwzoGY?DF=ONik#Om% z*ax@or3kx2Y&|hsz<1*UN7os+!z;qCA1d=dzY8ktisY8w?+XzrUw*#9)xq1-`bUZ~ z^W8&%iBHa?#RF#tfCB)rs4N8%f?BRDQsycKCWmJxX|R!=;GWt%K2~Twv7}M*~hlhIc%?zE@19@rCZ5 zE?hT(H_v+Ym1in@&aBUj41bU{b{WvURi;byT1Jh`&RW*H=!Fcqw(C3 zmW;zi&Nx?l*Mv2`i)D5s2a{WPrUS{1vNEIVcH)FjDe8yd?GJhlA9j;jMRc0aE=9U! zAi;vFxVVV8V)+^s&<^r*6={h8{7g*lWI#3_9ZH?@bLP(6?*$)x(l&R&s`dKD#{t#N8EPb6mbL|0z22-%gUkH zzY^Sh2;R{1(0yOO&A>u4CfrQs{LwA=BJp#llHbS^ZP<_!azm<|xw zraf=85qP?-s-)LDaWDnPcM$ymq`9CySL$SIOyiYJSFwNj1|D5Y5M%=QRE?+}klerp z0b9AL0CGg!+CMce2K{P178q7MZe26xyVbj@<`1TZv4mm~d&4DLOv<`>Aj7w-Ly*vJ zaf~N2=efa(@R3lG2Mlo+Fh&w|Ik+Fc=jS36IRzYh6mAF8#u+<^dV9?3J!iLhJ910~ z;e~5YKc}CZtPGSDR0CWS_>BOQEC2$QS|tZ|V2&b3p4~625AoCb50&_nS<0hDEXv>$ zTfTh)UFGT_L^nhZE?d7x1-57!#QNAfLKN278T|(O=`O%xkDENRA%ffs?u)lb+TPC1l^3=*4 zRk1oVFHfb;$d>1%XXUGNbFz>pExix%bNSV^Q9tx|-*_AH&}kRvw%!68w2@QDHO=IAfKBUNo#!+AvqAj_ zn|^6JY`p2{<-%3&kvT=B`MK&Gd6u#yFE=L_Fs$l)Jj=mu46c{R{`b{iW&WADb)^XKDcNlC8?k%~7jVd5}VWQJx~dqBvKj)F?7DGja`Y z^aAnoDE-#mJ@MxKKHzUZ96wn{%^K>pA=t)_yBynp=W|@Fs%Y6#E`M1^o1LvI*YEDS zB`!!ldXQdih52$P+2dUcz8XXg8fmjS(tYmt1F^P69&M#Q_}%oU5sPK2VpYCMuE29o+oNZeIdYuBA2r!KxH{Xe(-qrEyhB~>M8EW>27NQvKPkd#6jmPbv?Zs}OtPuER>RK1WXuI6pw~XV=7TrC@Mldb8c6udt4J=Q2)Epg`;W-5xFo*oG zz&AOOH+}Y}xPJ(s|G-a;2b+vB^^zA90p(Gik&>Q+KA~3U7iMGOv81A~q$oEP9W^B@ z^$>%33B=FSn{%x{eS3n(`np_)5opbCzmI+%$L0sFO6sj##$9FY^JME17q+eEr3dbg zUOob)Hrm@}^t%I4`65x8I?Cne_r7>{z`%Y6MqmB(-M2$cmPkKR1Dr^iOLQPJN24jk zFjAx_EYsx=(G(TrW@o80(=*n;MEvZ&SfA@T^`{x^*vcJB>yPn>p!!_C7L7z4z+^UVjBf?^mZr3zrXP{7{e5Au{{0CiI50dgoaGbbyn3Nz?^fS->}ZLdi5n={=iIIDP9 zn9Xk#b~;ZOZ2YCL)YCjJDK7MEkwl&t8lRtu_03U+n3t#CGM%=_HM3e7csyg*YxQuQWG!`nW;8l(FGwNP7S4I8*DNrvCERpWZh80Dzx^-yQyo zokUjB(v<2r?)wkFGXC)GZ|5xh{VyLQ1(^o1f4=5B6$a{Dr6wP_hhPs2i&P5q0%#tA ziOQ0v=cMDwP(UjkBv1H0IJR?3jofq2GS4W#!1TnmDFW6{pM25{C4Nc`f9r!UhE1F{ zCm_D4Rd1*_L^lS4GFi4NEv^`+T+-@g0aXCDlI z|GU3__tV^&cK*T1+m2j%_N*al`P3g4%>3cQ;bTXS{ODbi`GFa^DnL^~sWqlBaQKmz zm!FrfP$*S!+Va%c|9};V9HlxZOLGYVCKVGj%z5XV>a_qjQO8GDojus0UN27ZN(rrU z&EPt@BKew!wX;khSsk2JUVjeLD)h}-*|M>peZGYA+h4zX>zlv+!bwwSD>2uD`2w}3 z_*?kvuwyEP0uzfW+&5Y}PotEpG@0_8yzHEl1cQpy`y-yNJ*fq_#FnjPdHEGb+k0={ zJAPtIo4l&5FgmL`t1>=aQ+KrU!u_WYbhJr#*O?~2g};6K@n;`=^!>1ja|K~}FjWAq zlILXPDAc*R-zpV3fb9ZkR=z@|f$Y^vk~=X+uF1jJl1ac#Nxkh*Df-djof|g-sc%zl zMS8KO@nBbXFa6t7`l{}3clVthJOoGFJo?#_JBN>G6)S&u=WXL}ewu16i%To3%+D)C z4jrXDEh{%SUy)1aeyIQuKkT+TN0FbeROaT$^KxL(G&#AsSvy|fe?I7_+q|U~pl}r% z*Vn2m@~d~WoWJ@6D`(yGkM}N|J$GdP@%qi0#Aw&46Q|B|4v$SIJ_~L~tyIH@QDn;H zc@XYbP@y6;q6*5BQ-meB0%c)gj*8fDm0XYixu3Ss-EQ6taNF8)b?x>#JPM^MP?Q7M zwgG5B$C@s+wQf+V;;~5-yA{0I-T~2xP?0KRbW+Pzg{2yFd^9Dt$zWPo(;xWc_|cpD zVGb;_3O5DIsFW+^xfxjXWAHy)=sCJ;+t$}?*iv0uQIfxQbJeD`>kBvJDRa`pQl;rB z@o_QPu?e!En84VKq`Xp1aXHC91SChGxmBPS=4NCSKskZSsxIsgH!U|;sZ$MA=M@zd z$`zz@<^lICH%rq=fI$e{=rrBwt>ra<8{AZ)$_G$nO;yE)Emf68inufdaxwthaRXex z3ZU7ot1d$Tg*yXSTVX|M8FGv$veV&u=oE(P0?p@uRnC&DfG?brUr?AYN2kfxXcX{G z)MxYnphF*@sHm=~-Mn!th^`}8gw-2#)n?_&qumrbEKtxNiG6NX{6^=j! zB9g{bKjf*(Q|762K8GG=Cue45rpqB%H9Ch9uAowm2e}vk&?b6TPb07ltE$$m+f)aX z#P#a|9|{ESDwU$Fs=TT|nFo;gBFqyM0$;Wi_;Wz8FD@#<99^NBxKM~eO7m43rBPvl zDm6)$Wt<6weKpYca+RTE?PK>!6*D|-B`t>wr}Rk;>0k5$0$t6IN)ZD~byc}`&! zNahz|DzZR@R6{_*MCux7Hegr*s#gx<0WHr}6_@2>qTo|C5b+eba=4H3%v=px2;Dt9 zJ@X)*ge1_Zv~DncwywAcFp6s{b=A~5UG?bAm{BZWuPMNNtt~G>vIdMm6~N*vEdZpf z5>a*;CPE98Knz4Psxd4Tm8d_<$%e-WVG%q%jFl?*E7|FVcn-YxQC~%G(@)Q>1D606 zt}4}){9Xv2AYC=?2RFgc5%MCfS?X5^FKrwfTo8rR>-p;x9s%fZ%FeLWE9)Z04~Q*jO{H1iN! zDb$6fr8)6wr7BfELX6__b)`swgsPGCL8;0CLLoXGEGG6q zPI^W{O4*U#+i2O{P@z!|DiY$ea|jk9!Z#Se!t&zGcm#A9%b? zQkOeKl`Y5cuE>RwWab*`Lz(nLumoUiO5w2)s|<;(S>s1975nw!>r64aQm)2Gb1x29r@{#(^3i!KO#t= zJLyk)cO^t5E9B@8a@;U8Hfa#;sCAmJ08I_yD&%qm7$6HFW+NuXh?TC8r={uSRK}3B zl#d}Wtn`$$?3Dby3=HT_`Y*k7_my?h$dpVpL>i<59&@wRd03}W zs)_PL`_mIsVLMV25_L)MBqnF3Bxa<8URrv3%Akz&)Qr?P`OfnM2y`bs39~Y~2aRcA zkufP**`(iOXUQ|O<;wg5MQ*-Qlc&g5$dl5*SW;|467ra4XCxz^0i7Cn0 zO_7L6n`5l9{c_%*<9~CM2aK#m24< zk|ig^M#g2NrXByQn{xx>!y^*Y5~5>bl5}a` zW@V!NTT2cMUM?HFU&Yz#r$689#;(Q}R z;#aSUS%XAxaWP@h(Mc(BQESpu5|dU(Bt}H9j*=H|Y#AF>TxYN|DgX~a>42*D?DmoU>vwC^$(a$c z5z?5T2uMC6H!W}N_9I<)@6$a`8RBah97G+NA?|&6{mSw7X6=F9jq95Zx8J;d`AJvr zedek%x*wVkR0rzl=K!L?^gk-O%bY7=9(@Od1iUW_f4H)@_rC=w=qhR%ASlBDTPda_ z0Il?*>?k$>I3;*VDF=Lar#_|FkEIl=n=&*JsdZWdspT_@Vn3A{SQ>XxhGx=goz^f( zWY&X&&!h%yGeigav(G7th09nJjU&BM%JMnYD}6>88e2+xwMJ4lrkp74W15ooPzEO2 zXF$^vp$Lu`sEr>`2CUAfIAp2Ap(nIK2MZPG&-GH26sM$wt`^}Ts>Vt^=t{eASj*BA z?WGLNx7Pum@c_E!BzNqQ?|v(nA|*rP8Dh9A_%g(fzu#+KwLFhB2x1_3L$1KekrerK62- z37ff<=P1^Tn!&j-3K?}I>1lxjl+>aIE%Zmt+!(&F`bcVtJn)-bkVKC6Q2k7#bRP#O z3(h-moRK6U^x}FVZ2fN{$mihFM8{N5$QX1nbhLC|?N4xjAkv9KY<#L;R8Bo@wEOGKBBl=7KTx&N9lS)Aj2y(S5=Boo(+ZSWJLFpU&@%UpcjZ?2ipY9 z_1y`@dc8*6DRbqY>jbT8U`~oCeZ8a(DWOH`=ms|sF-@7ER($p|=_3s(8k6H}Tqy!9 zOqW(<@`^0e051jn^4eDy5DDvO0~U0{u**bWF(GG0Dt=6EUkkWDrXl;W^i@K&pjg^R zsJIIqKx?K~x&B(*ln9FRC#51+g5y3Zyr|6#BCXa}2J)!HtXm5p+`m^LdR?{gLo{Cp z>grVVkf!Z7k!hQc=`tG zkb!Y0X^$7=`yut&EBabAxD?WZQ6h39)F9VRshX&e@g1rkOQi1Vq5GNP1Y;8P4e{~{ z2>MTwA|hu!BXmHu9~-);lQKG|za3H?Zj@4kj0rwF^cD6)OF)sRj)xE|^wziog+Yms z?&!rG=&N~o*_*X8J-8aP33}?<7uurd4T^!gC&rDbM5M3N2z45F;&{>{iqk zpQgXCRIp2=gFi%Zy%1j9=Zg!B(4$_n;G`a6^m|~#DK(1q-5rFJ1m*4|B4wmSKA|xk z#zg&~FXGJesPWE3IIsD4WI zGiFyq@`fE!;};CPs)o7BQ2jffx$#4Sm)z${dC}{lXB!W3pnRvadaZCAlT_&KBZtI%yiUo=5rnOjOrl@)Y%P< zOrp$)t$8Yiy+PM|DusK)oHFc4VjQenQbRUH-Nktw^-v0ZV)sb9r4$?8+YC;PA+04{ zpz9e1ED%uRvzqt~=tOXki2B{44Pi>|GJOhN#F%J)4^1pMO&PGe9@6MVq-ZsYl2M?8 zkOFmf*FF7-Hz}ZNKWEAtQf6J48Phu)Y!uV>Qcr0k6AH(>^he(;ON^VbzO(_QCEJYP zSmFLrxRaP3d@?roj{f+Y#goW2`r?$yJsO6J7z%KVcQDXT3R1Ud#x%ci+r+S0_LXEm zr7=LjAfUVy$CFT!rT>7r>pT0Dq4p*Ngh^>18F-S!X@GGA9fmW|VMDr*ExD-|=W#UY zjds9XDB7xz4jkea0}Tj4hHy@p%JHFhzg}DbN@z+b0M&`HRola;21Zr&b4EQL=!; zof75EP?X#R!U?#IA_Isq3MZjZ-*MDPj{Xe^7D!Ni zB&3+sfTS1_xN*IJh&dxiL4a|_^+(AsJr5?ZhUi-i_vBhMwwg?k5S#Lf0y#>4{VfYL zu7Y*@69LiRB_R4o1js;uA>dCWSbvuU>mQPUDf_=AAq5H63oa}fNxaEL-_d`_1tDSf zf&`c)m|}$QlLpiPqmW4_BaT;%`rO^IIhNI&?X;Sn-!UXBWxA5z4YuCZvli1`%F)8NQnC{kBOnMu?UTN}+`k);c za*Wh33K}8;B2$03*S-o3j62~Pklv^zq@EGKhPhu9)uO2MMN!1`W88W ztCoV1~uwMMIr#Uv{y^!*-pOpy_Ui)8&H2r2=njxbr(Uxv(f)E-~U&l z|L&ImFOnz%yl3*e|0CZa(V<8jHJ`FTSUH25i4w;;58GkSqMWd zaP=ZwrGHuB(+byFGv{YBslFCcBlRKaRSJHpNiQply74k3C2{9dM4G))L<%pbGCI|; zd{3l?7>AzV1PMiTtjGEz>|4@)Y)UFcREp40AImb)DHDQrQ;ZeH=mN(HzHO%^i7^ae zE{X4;g8?U&vRi));TC*=YBJcUK?)(AK^Mh@sU#MC-badfbXpux_m%3SbO*!{Of$sw zghb4!1wx4M4Ac~fS4mvj(?^Gye#ZgK_Px&0ZB%N~^Ew?98er=fU_gb9_Rx~(^c4{* z38NVz^Vex$Sj3dlYphV6h>ajOxNF9c5za$addXnuBELcLbqdH;fZ4IvDfES@CePp& zQxJ|miX|h=Ym|~O&UYmxVSNM>nQs!rg|8E|WPBY8A7qOBwRn{*dc5SV6BIEtf-tG* zbr$hmWJzXuwXf)s(HLaaAP2H$APcGK!&?#@G8d|)Qlect5F?Ha>op2EM3e$2Sa2># z$v)ETo|i!{nVp~z?U7iR1bv-k>?g!ue7@ikeu*(2K=}`9fS*b(e&zeXrD5j$;fR1T z3F`k5W!6i|T`%f;o%g>-87+s#2d7N<{VLdfQ6BvEQAM}{whSSIe?rrM#J)5lT1+8> zS2Pt`l1)P27XDx zLBGKrLS$yGvoETKIsG#olPA&_&7*H$bbr+QH%ys;j#&>3U|)z$Z0Re8y87-|PXbm; zZTuz;a84r5&gT@q=>u(IME?gy!X(wGA1rkH_*MBv0m{Uat`nkHQJXHGx{VLA*4JnFu9 zoM{UfB^|mAVe|?8XVJd0M%90Z8XMFQfFUqo;`0{``_Foc`h{_O;~q^w&IE-`^l?0X znGt(PY{5Sx`FCs%nH(b(A$q`BC=wID|KAa0ETWzuq@_lOlKwjhivHaM$@ua*hY$g2 zWgPuiEjOh2=bQc$Nz!5Z2r{OMG!>fdO$9omw+i| z(uAF)Bm7gc7{AchF^Bw;OH0^PV%05ioH5k@0u5$5q0ePO6Hr}n$dWK2+JR4#e~Aw= z(?BK`UL#@&L)KvoDlD8}tkFN^gqd_8a}0gXA#5C_hEeS>Lw8~01mkJ`Q!>o_12fyu z=kaQp^+z13W@bGxC!+U#|0$){<|6w1a4nf(P-7|+t3wYdLt{}V^OdOFKc)8i;)eX> z|HyYnqVH1gQtu(B^)J+DY9zBRK9L%Q*H8E(nZrjT7x>rI`?%t5>fIewFAM9za7%im zlyM7%=~}XorN)#mTmOr=i&%N1v@d?b*Md>s3qO(x{xG|1U@0XV6WO3+V40-T8YE$U zcmOL&t4(5==vX9-CbeK(Fd>UTa2Y${`mqq;VFL=8c_rVpIFEf_2mr`t7YrhV6%@g& zyMdN$2{Hp;mU<(J4-%JRU)t+ec4A`^n<=eknAXv6b%|K4q%InjgQ$_nm}23x9~(nT zFLukYS(b#EzPd0#W5vbL7(pj^z}-p7#xL-0WYWPRKS)qc*kQt6oa@A>$sB)0K#jB2 z3>{`L?jVK85*I#25P=8}`e1Nme!W?g93{?gCqAq7cmI@nfb09@Kp5z&2sGF@+M&}j z`rKdn0LbWr>s6ch|BOAWdq6>Lt6*&RZtyv(lDP%WY(Nn`ojq# zojyLW?u8#+&!srPcs95{(q=|x5E%K6iJtz(QZ1y0^PN&@2adfgON4{rmu1^q5`%&z$G)om`pWexHz|EU+n{2MpjVu2+9W0)TX6rL^qfBG7N-Pzw#!>PYeKf{2I$F`zreOr#q zG23g2IbSl*y96`6%Q4q$LoLP8Ig|$_!d!7M6@*>iJjxX>0p&w^W8b$AwF29k$c*u9 z(3y@G*~&Bxe^VIB>3h8Nbw2 z8%pn`nm}tWbq3{cP#5rdiaJXjr1mqko2XXM+k^KessptiMqOH*ZDz{tNBMfZnouu! zWl>R}OYS6!sWF_AVGq0ratWgRDIw$}#xDWr?4s&W+f`6IhMIOmL;jy?#lNnTLnvbmyCbL{8T}!f*Yxenf(9(YYaw)K3A0kL9Gc;P zyCka$di@EdLZB~vXpal!hUW$J`eTii2C~_07AUcxD--ZJ6Ms|iN4CQe`qQCf(U3XO zAfi77(4Piq%~rg2K(;&3X4_uVpQe}kbCA&=qDLpu?hUxE39o%HXceGGS~47z^>h=k z(>az(q*9lMpn0oU1Kr&Lv(5yXvaX>v9Jtr zR62TJHKa+b&o1=JEqJeI?2i^YMeI-WOZ_>@ScJo9)f3Pl(w4+BkruCFT2ik&2cbDcf6haH&f+`Kp5xG+Lre?nb?gw@`V=hP0hDWJY9aP( z59(~fAJL*0`lIg);m{x%^hXTq6Nr~jpZ*9L{i*BIA7X!6U$Z}LjQy!ZKOIl~idGl_ z{rT!&)t@k$ybdz&|NHqrQ4W{zK$^Nw2QZ<92h7QnaU@eKtt;z0-bKHUpS`_3-Q7>0 zbwBBTj4OJ`g=_mRxJQ59`~3OSM-T4Yx^?B|?VC5RUcYhs)}04W9|K=OSJ`*fBl;WQ z2|VoTx_$HZjhnZwUb%Mt+V!hfE??|CfBDjtTMr*Tdr9yKJ+Qa?;k{couV2^Q?02W@ z_H88Oz53pj>sKzHzkKn+A6G74y>|EEv+6#|&*-n8KY4fu1E_=y8Z zK)YTo&)wU3<>|w_m#^Qvdg1(q3m4Cyzi|G_1E9j{3+m_*x}HZ}x4Z7$xO)Bc>Ek;$ zHda*@%U1$G`XD(iP__Ed!$b0(q-pw1g?%)68 z+D`+*yKdgOb+)m-rfx@hf-EsZQN6XU;pp|d4N70DzrIKP>{-=z^vu~a=gwccbnzVS zq4U!HUOjB5C`r_Y@|efIYAtqc!Qc!aU{@!bz^UB7kX+J!T_H*DOqp{A&|<0|%X zLOIBDj-NKo8Zy}EOOMJU$4+%#I)CnuOJ`1^#HXUME! zbk*qj-J5qGOuTjNOq+IR`{Aa1!F*onsmoZd?0tB?^WxbDmml5-N+i9@!sv^S4GgGn z0`^?Ea0xed<;v-!N6(x)cCB|uA33DnrJvpJx^w6Hq>Jr4>h_+zpbfL0JvS&fDSF4j zliPB_*MvvPqGA>C1&zlv{0Sqz8t~p=>W9<|7cXDFapTI>OQ#PXId$TAmu_d@T@HA5 z=gz&mS34&i*uL}Nm4_$1X3a96>t$&^!`Z>ra`uAxmJ0z~%3aEJi;d4zbEo`(T#SRJ zuRVX|+Rf{?u3hZxXgSz<^6XtbwKYf#{PfO)N7t?&ZJAu(a^X?8?ttfvDZl>Z*D=5T z{+FL7&9ww%x_cO&4_9R-hWf9GR)+eI`3UI-f=*nzarxfu8`m$N-QRlR+_|&Qv%r3-XAfihoIO{Xtix_kTf^=lW7>}xo3_Sn_lT`x#Jx^wpt1kq5}K;7-7$17NqMwr<+ zOG3oqX=PQlb(^=>Zr!rBwpP1g{jQx`%JVXl)`(NXe&v=mpS^MW-o0B_uAgpgXzDn9 z^nspYJpER8*Tcs*4<2i4XuCF*Sf&Guz8*Qx!9P+Kn^RM>aYOZ{%{!Y89yzf8=%E8g zTaajWM~zw;8WA6X>_QZ{L6Z;PRo4?c0H8 zNKd}(Z2JB0&ViAs>b2{U{A5S#fj{m%=%%00-N@IYyYuw?k=B|GrMXewo44#adF9^S z`wzRWTsY9YWy|5SNADw*Ik60h^pKu=UC$ogIDdR^ZQZrr&*KY~SgxpzAWnYy^ugJkbyWpXaV4kEUF^CKdw1=RL%TNB?7np9B0~@lO0`n=&(KNq zJ3V*rK6-Tf+WCgHm8YKR-lMnAnQ7w`^8c~+9&k}zTif`V4h+2)5iHm{Y7#XGF)@iI zBr&F8dTv6RH_cR|5jA$PQl!^`p~KL7??bOc?+Q|fUS`hs>=`V{z4!m#_xpc8k(oJj zID0*Nt-bbYd+%GWp(0UCT9Xuu$jB2>#yQrSo)~`al(_5O$oS~+=$#I19dstFv!Qk- zhfby`$$}dtt)%f}Yf9WgU#I!9v61P?I|Dr>K__$Nv_{V1gP$Keb0Z)mJ|ekx@*a66 z=pCxb4n5;m*MDz(bZnrft2xJeqkU;>*`VT?4hz>obv z2CX$YIypPmKTz!d@sYdqY}DKQcO7rKh9o5?rdJGO#k=8DPwqwMj)_qsJUwlVKTz7< zJ8_c%& zohlw2o0u56)6-tGn_{1AYp9hfo^ljV5s;LKo7|r1D3YQqAk$H9&u|pa(kfy{dwWN5 zuUO0wOR#!Z!LnPJGslOgC-0382LIFIGEGN3wGP{h`-(D>;)@34t+c^-+8>ekCc&eD z-rgcjY?|HER6Z=v!{OdkFPLL5x29}S86viwvu4;x5a?38vzKDQn$%(5nrUNg&9Jsd zdkRLPz3F=s3uFD0v3m{PnWyt@wtwQv3r|c-jH?-!x6t|v^;g61OiD+G`n&I3z$RdO z8oP=+b4hCgxi!N+6OWN#;?JD6W{DBrnzp9w5I}O6ezXxMT30qAot*6-lzhp5td{OL zto7bcH#u=xu`%T{5}GyW8`dM2Y7F)F_kGS{P`mGTh?`{!M7DBkriiuyCI^JUqEVGv;j?;i^uP})yS{ez zrIVP#yop9ye>5s|7-M8~Xr%i9LRot{+eCx%g$=-?Fk2P&(M*pNtKRXkX%F2i=oNA!;#-ftO zM+S#ShX&J)(ef)@on_6rq+tg<^(alFeM*Ez>_}rsffCLNASD8sH3F#sjdy=<(uLNa z8=IP$9UJU^!NOcfI~ni~o(+yGU?%2G*3)W3!enU5yF-JsC*%w+`>UC@l2&vy+9Zz? z!Nx&{Q%9A;F+-1|AtEOKt{Lgb%=A>hEO?9g2|CteJh1G`DyAs+!PWSt^OpOl@4ULLS7)*vnKz~O?TP|to=ma`Q(E?J_Xh$#u z`BdWk7d*FdWbN3*{OsHaeTHRuMEow3ci===0uF9vp{`2VP_uA&e0=2YNasf|1XQ+k z4@inI4l-y;I!+)d`Qxz2Cr5;M!7qj#kqXDZNQE2rN1Kq&EzFP1mYV3ipZYad?XizM zB6HJ9rfV_W;!9?wlfwfeEl)EU9OLICeGU1_W*}?GX1G!IGHaHErXdA{F>DFMk-X1@ zQ7UzVFyaHt*3Au4^T;qqqjSSEGWpcx)LYCaLvok#cE0Bqn4Fm~NTboo;MUo(@sZJ? z%;glzOz)ks&W3_s1vVmk4jA5$MYbbNOKoM=sz=@2FvKwa@PTjVsQ83-rM7<=^JsBm zY;r+5Bp0$ZzDW3(tMT%Qgv7j*+6C-NXb8T=NJ)!hgP-E0IV0-yU|&t{XfBj3w}6lXjlot~eYrO$J$Zsl81nlImUi_1;v$J|#3;SKAUogD5Tp7=w9 zrOlzN#s}Ies%5!!Fj^7I-58=?qNxRVm)Sc(GZl~=YiKV#*I-gQJ2yKiPg%`)Hs?DQ zW&NGIASW3L2m?$`cPGqDOx(LOUbc+l8!(w4kM>EjF%4d!c_PQmUi1}FN!DWWC?om8 z=-m9=^vobOo<9+}oYJzp;h&Y1hn>9}NjozsO$$@fp?f2)S}JB-N-J!lt1fSZJd1K8 z9bS!R7|X^dWOFl?h9qBxJ<_r5wF$FcJ#68XS>U?NM2xM^S5A`&&z^ zWy(j)U~o`U@({!6!I_2GsmcBqsja!L#?-oRoxL+7im??=0|s)gcz$ARWOV$PnyCec zqCU9SQ<>bB4Jw%8qeSFwkBTrE`;s1)jY?-{W+$Z=RHzfFPw=!}zv&*I5|900N#__1 z`${LJLqp@GOEfk442Dr!e_Ltxh+Lklu(W(>6Kr8OGAo;%k!P=@wiUk4Vm$G~Ew40D z1KcaR3C~xjQ{v{N6N7^jKT#~UoZ@{tJkXR~DPK_9YCg2_+`UP;Y;J1sM^%j&A&=5~ z_mo3KTppHA1)$F?4(jd+mRob+^wDIh~_}u*TOygse zMTU<)Wqjn?nGiuf+`M`Gwb78r(D-Qoz0unBoaLBGd4bZVhQcO#(RvM_jj`tP-tgS~ z%+$C8gSycB3PWYztv_yi$4F=B7O>MOI$1tB);}`!HMLrw(x9H|YiX*?AD2CN0NLEJ zZ*pONYPNVCW9P8DKDF`3YiGS&+NSANU^k?D{Q735$L>uhaX2O#{3VpfsHCC1PU(pF z)5Z%!WAh6$lf9o&CP4+8DfJhAc5ro1z?S#3=sUyd*zB3Hu@ULWI}9}w9*=r%=w3%< z#rXZdHX6UTAfFi$&Nd%w5gnK6=FKQGa`@Fq1f0kR3l;R zPFGbMU@3bq0Ja*8omuI4?-9oHccZpYCWn6h_2%sgxqOCh!vkc~sU5PhdwtSgD@uil z&VOv~&fVsUNts;f_XJ`j3=hvtONU1T%+(V5-_~P3_3`&tT!X>;X*|JXfv(P*oq(4; zbD7Iz^OzJrZl>>UWe2_J*9Fo>Q^ON;HlCMCC#J`TyRWJ*6%XyAbYA}PM@L7@-0~^X zzPvDh7U6}V@vpI~@=^}P6pnUu!$X%XK0rvbVV93j$fvYN$8z^j$7yF4`|00*{pH%t zrg0pcLG~;k%@~^=>>HX6*J7BwV#T1|n(FCnu9}p~m9DOk$k6oI+|<4x+a3Q6BZff}6gzPOAW1St3(#X8m*(UDmAvUh01x^GkRq+)JXCbtc zY;<}am`AhLtNKs8%Tzt+bnc>)Yo8R~mD;%!oCKpdBuZRYrcIg>6N(@y` z_u@@&E9fwkOUH&Lq@&|^exSahv&>oBE_+^*fFUfNqen3#W1j|EU^9tXBXgFXwq|19f)Yhrqae!-{+8mJ{h&3| zo<2H@$(2wc!W)|wI+To`+2O%{=)vyT?aM2>-rBa>&iRki7u=_i*M-WVyNLR#%7KkH zHYD>@WpH0IqnN)=bobU)EFjdy5ZR2uj+K83 zr5y=Hgpj3R%W&`H?C?;^*(cowVt@Md-1R8WTV8Rk^?i3ohv%p1Zp7~BQBgni@V&{d zWfZmYRZYsOeW<6s4ExUxl4*NHVU>_xA-;zlKEjlEv`>a$Qui)AN=fgGHKD^EbckB$ z5PJFeK>wZ5zD`MQa8XBjT~>2>Yg=JeL49#aQdvY{mZVj>AX@+}#xlAncWz2La&P=| zCR6h@Gm1Js-_u!DCm(qvS!*Ib6pi@{o^&)= zBcs>M_I7u)G}l+xBvcoRODh_R>uSm?imFShiYoJJvr0tSF$LwV&}48fjr*bpXJ)6S zWoeiIo_hlu>Nnl%Y$+TeeM9x4L39eC2xdmFH6aO3#-n|64}O*GLDvwHz#Jk@R4?IH zGxjdyF3=Nw9j%@6c9q7q_J->ECW%B|Z&+PfUQt?BDlRI@EibJv6{qD!Aec4<3srsx z;**fRFe#PJO#KrpfqpP$Xr)hdc30Lw0fR2l43ScMV0L>z9jwDM2$GM{gr>fT`hu=DOyVww~^ePDJ!N5gcu8Zk9AQG*pVqDk{Z= zB{hZlMOCGeiV{&&Oa`-iX6`Q0=K~R=6XOFzb6#3ZtMR_U7#<}S?**AhaUIU@eUgdTgJK6z?1l$Pn&|{ZV zb=Txg0wnsMj8XKS@|BQ9JUL2AVBqS1L;hDaZS#nK2JE2Bt7meR($$^=7pAG*?z4#I8Z5F%wFFg2n)MGp{ zq>v&ivk9K`GLSxvP*-nHCnDe^0f3J0>}YIhZEx%9Xl-n0td`dr)QKy~LA_8`0uB8Wq+>h6N1 zx3+e+wzf3XN$P7Giz^Cq3(^X63rjQeiYp7n<(1BFxJI{?mE{!{Wo1>?RLYAO6{U=# zLRk@~ydW~XYI1_u9pa?%u_0)zmvoo@a(h2RC4}y4Eh(4+@x&=Y)M-)P|1YRUe>2=b zIwg|8-F;Fv)?O#+?!9}rL(*Db+tN@A{aqri$SW(YtSPR`t*EM!R8{2_7gxvVGO2B! z|MqKwC@wUyw4%7Eu(Ya#F5;IJvJlys`D}{izN-s%|T0X9tFkw&fo2)n`xz`h2r9}k|K>F zad}=&R(5tyNv20y?+k4wm(3?vP2Owo8xS9`deTL-mCFs7>TS!syc+L}I76tFf^vJFBR&q#{4PFjbHf z9h)4H^=)dbFzveFydbP4cQbYH*r(qHrr!GSc1A&2Wpzb)QL#=*WocnSQC?bRc2-hE zct56q1!9m?gpN+!Z5`-1Z~o**^M6_(DtoW3Dz2wn5t?GyNv3JoW<&@5M;U?*usA** z>3W6dst1Id3>deMFxnl)6 zzg{`ww9NEUZE1XdR)lX(Y?`g9}eHfE;JBL+`N#=!x>%-@OcoxX1gEGkTxICjLOp&k_;=t>YTX{7V% zXXmB8UEQ7SckXsIOByO_>%;}+abC%pvGv_09m&@&etz()58i)r&#N|X9L*IrJBR&# z>mS!$6Dq~!W#Z!0@XV5GNp+c6yINdaP+W%8O-gcdR*WEYbdEMDj$fD>9~i4S{?^-P z)4tQCzMSiAuZZcQ=j9+@B(-KZzz%=3??*u9Lv0DG)Is`J%CXiAniBa1+XlLTer|rK zs~x$~yLUPy6_qvhg-Pj!SrvDZU2lK4|Kr0}mXx;js}__xm$k}RPiL*B&FU}gFMhN0 z&~L*0qSB(W(!|*Gl8WjYovMQ3(kgLbeqnY>W@=J`UwY31Z8GE9j#NYcK&1UA?@C-P zsWmNQUCp`K3o==kl6E`f5dJgmqpuxJ6uB$3YOslOb z4gY!j^Q-wLYu5SE2hCR)JV%GFF*7haPye{Wz*y&$#9m#U!(#EcM$10TD$2>Ks*ZM# zDcRgqUxQh!xU?)kCnGg4KTmWnb_|E5cnyq>4Bi>=So7H426q;&cnbfSen`E-w|GcCSz9;{^6P2r_dkQ=ad%f|Uzen!x=x&!oR<@F{-Bx4YiIVa zSif?aBzvQgiRquxXLSv9pPR@rH`M2>tS;SUs->#BQI~^!@&1ePO(kVTp`L<`X|=T# zRkgKMFwxhsVc9n$`FYJH-3GL$+fZ$r{7&_X1M<1 zN2bQ6>hB#{Zmh5Kd+W>k`s(X4JD$@}Wo!O4@~Vyw6Njt3ms(U(n3EZ@-Y2WPyuP6h z8ni@QoRJn2DZDM}x$8YS*w=S=!e!}-Pdgk{xcdhNS}P(e8)-(b-J~Kv0pc7MO<#rf z{ObsQXfGp`@i!bI1rAX?Er#nrB&n;Xqb9Gkp)4lw+LuqPd1l3`ts5-D8lT^=!rWrD zuD+q6j-i&GzAk_FW_4Y4ZU639xT-wvvps41^$j#wa*BJvrMe&|uXKG_KtyhJrMMJ+ zS8-8xW?GnkaCkvN$=u*T-%$Q)y*0j-J18o2vZpyKe6$``#1xFK|JL?#xNrIYMXGug zNP6pWEXT`oX-hLq&JIaIesx1`;IZ$X)npuS|8VzX+pO&lY_ZzDe#6rBX4<-XIvP5f zTIyVNH4WX%Grwr5s4#d(yf#wmx@x*>aJ-S_ne2?@lJ#ZL&S6EB<>H#E(z2rbjKq+r z$Ox~%@#+410|P%9>U=wNl|_BkKhRkfRfk=_sooi!ca%w@^Ah5#DExr`IH&ywTNH)* zb_>>s_}kSXF7zsl=n+XP>MXkJDk`dqh3CH5uFYM&@7Ql|KCx>T4q;kqZMu@b^6?E& zuzW2|Ef$;2Rb@R<6Kcufa@kA+9R`QVSnuz+hRLRkK98%&SYKKm=^Is0T~ShAQ3-XG zC`ybAyXDz6J!Tf1)a+U44sx@K$5IcYhuVICI}yYCLR z|GGrSg?3P-&Q0HGFBCS@G9@Tj8xAmv-2R_{s-$0;?r3i9?rh8}tt(Bvbii=a)~DXK zS!ZFs#LUptP|wi7(9me}_HF7EV*1*AF3p?AHr(r|j!vCvQ!oj5 z1pm+QK<;MRnmZ+Z5^;5Hw&xcc^~_C-H*eHZH8e0VGSbu6)HgKH*V8aHGE!x-)s2_y zs;HYk*7fO{t6qYiP8j2SE-Y7|RM!I>Md?1dhM}?iw>25L@i`fOH{-?CrIq4>yxg4Z z%$Pu*qcTE!%TwOtB zRnjFpZT|WVx|%!&S6xpZU<{xR^z;n$cq%eYeFmkjXU5-os@VB?&&IP~hWqSBJ{7z1 z0uvKS5Z$k90(4mHRqKAMOpDG)a=o2cUS3gNkP9y=Aw1ac%CV3rOPz0I89J10cUOCD zWG;>>YX3Kwu(@;A-(DCeulFE33w_Ldoc+ZIDL4Zen|n!1jjp^<^U zju8ftDx0UF!b2$;#Z%*%mSt{Uo+t@&*s8C|mNB#_g!UOs-b*=sVJ{kUDaP7mp@ngx z%qS3Xt%E+-3fqPk+Zme5FNu62a&H ztnnW3sX?J0UhbB3_V-p6m8QpEeDUe^FRo{D)zmdL_0^2@{!Kgr$&ghH#RgpaNPZ z-Kz{Skdlvo2`fCxt_B#KPs@f|yZXDtg=Oifj@FtsZ@;R|QBecO)YUcA)l@Zfj12WP zHPzTEd=(~(tEvh;$K9#ufMC6n@hforv#mUedEyHlB8kz4Axj#~HfbGj@xSB0yp24I>Rsw%45I+}bg zN6yw`LN{peptYIM3g_m0Awu1b3&d3w z@O27u(z8T?7jOLPNk{2WAKvL~DG8{QV77#%DSg1EOl#{QdoUJz4pLb ztSMwFLGXbO|MXw@F>mDRDobj~&7z!`5btwm)2pk>NT{?VCnetH?B$Tr!wl1m!QO_b zhzWTUbOT66e1S+B5(G9R2=0j7kR2}f{#RURq@R$>?soLvDJiZgti5STZF$#bxhV%( zTP85@xI7gePmQmt!sBAHp_nWd$3Tu13DoQKLVXnG-_1(2|CX_>8TSvY(vZYP%2y8*MGL%n1WLl39 z4+kj3_p=QDBOgf4c^571YV9k_FVB%SAFzD!-MxKvIb~@z zl?S){DLk;j+`@8+CXsRGN(Pe&6l@-bJqIUgvVj9j`dP4Q7%VMARUGdL0CEg;WV!Gk z2)Gt1Tnu|F%2bPbE3-by-R;sh?uFH$zoe|ZBrE#)4}wmu`em}aGus`E0EAw95|@DM zNW=+cb^_vS9+jf@PHYROO_2lpA5kFvzR=fsr>UqayQX>{$MD1_k1btdYP>`ZWUa*b zC5K=VZm6j7*eoXa10HZ#svw`We1j_9W2PkJ%W*#tGG-_%-6cz?CI02f-Yz$PI+XDY$Tg87WgXQ z4dhBOi!9(yRfTTC=S{Dzyjb!FpZRTmO5hczOGkoB#p3ePqWtWfw9i+a@D?=mx1{;u z%*$#dvqWw(lsXC|?Fa=h#cq!HxW;^2C$7 zwk|cdFw!?L;*sG5S=FneXe{!w9=u=9wR$CgsB+piR{0Z?~7vSq2nqEja(INI8f6`(dA~+_c=>l$6Yj!_)zfOBaIztL4g` zXoL3Ix^TC(9-3B5Ms}wI<# z4uWd*SM&s-!F;T{tGKQxuJ>)q{F$qs-#)g+7&fYrzLuu08XiNYO2To*JiyCA3q*md z=nx*EjeH|#(hMfs^>Z1;w3BSZ>U}1)4Eu(tE~Pfa7hN);7)!p3&dbV7%Sw-rc$c~D zy7T3W=R;z$*-Yg$hF_P%Hh8ZCm?n`1o}V#r+ghZQ0&eoc-)5i;&Fg78IrNeo#(cVMcmJ zdgK9Wli%&jj^`X}?o+Y+UTZ^sOJRvfhg!bX%3_1nrX>bCM(S$%h(Pe55D61VR}cjQ zMZ?r4DhR^^1_m2M;?q1smtwwk-t%U6)FD1Gr3mk~szuAXi?14JIoEhv$uUzqr{?FS zC&tHy?xMEd^tyEV{3XAcz(rnI&Uf{c)Ym1oJV$A*Sh-}y7W1vfIy!pVI=b3A8fru< z%c=SMgH#4BNQQzOgH+Kmn1ArS)=G=lmT5tFh-iRnzS@_2_F1ns&^THiz7_;*IF(qC zlNuMF61aw1dENcSAD7NwXiyT+31QHs2YV!yof&1mTKXs6f98eFJD0AZLc;Wm-p;R8E=m$c^iiO^e@{aPr>VITrQ+$T&53NgT!GEgu_WQB=0%NZ13i`t!^vJHR1 zdo8j!n;c;K+Y%$I3qH?-$>TO+ax^?>jEBzIEsw!M{ z6@>JNRl-ow)xhJ?B|7K`MPE>wRzyR<_>#jonP-p@gD+;$8#p-LCL5_e1qpBC zI@{)IRz^a6wC7u<)W)lUE;wWE;+6A7vS0;6P=hnqD(ULT4SkE^tY2wvZf0h(nZHDj zt0Kp=Mah|D4r6Jl&Qa!Qnuq|Cy#!-{!BSJGazYr01XIuzDC__o^Mq@wtSSb&!_p74 zHWns44`Jo+J(-mj6(PL5ho@rW9_VuQ{MCyWE(DI>r((%yWlMWq!bKB`Yo%{&xx{Sw z25ogc4wv939EVlOP=S$2nqvT_A;nZ*$tNVKFNJSIu9D6{=}r@_9+v^B09G>e;ac!ih-~5`B!Hu7X3Rljlp(Ye{y~`-DELI~#UBs> zQIL)=a1yl^rAo0(S?jB#cF8GY=JL0MQNjTC*EuZSGdPOz=DAZBFP{C)ckVttW-|>< zE%j;NS}@-3xK~;Fnx2vAHbaKG8WbhLNK?y5n_Laj3fcig&dPO~#FS;PMBON^!3;-- zkj}wYA)sJ^fyoZSgA=NkQ>)X$H{u%O#ls$gK;Mg-C=C-kC!9lj;a7)C=T4mNQjRJh#%+z{1*y#o@!aAaEDal5q;LXK++mYU_9F;W~qD_L!-H z0;1(;+zq*f*|gXzivGcff}qK%<;IkCj;94tzB}!%`TC!;)ngkPd>rU=(-UU|pE-N- zM7lgiQSv57T`DPki-zITNk7wG(NS0WmH8(AW0pIXYA-c5HQDhLpTXs0f>8(uS|c#o z8u0Yh4EQ|D^@^#7vt;EGj;ex3DBj0CWXd7Nkis`6e}XxY(vVRrxGSg^E6!_@{@uIp zi{I^^hJ|OScO=-)$;0)!!^zVp|8Sa!U#y^G*f}Z|a40I_;6I9I+)%^zptuf+M^wyV z4Thq~j#SdYKS1@#98&iZl%tu-nrd2WQeNe8O;#>3!I0F)VcUi}2(GBBV3;vifh0p_m`_!8NNQY+P|s$*M9KW@cItRV~oVq*P#usStKhP;guY9Ks6#QgCvC!B`oyrgLJp)@cdjjhycYWZjo{ zZPR4H_f#|4;39N!z2$uEjKk^Ezy6Yg)tac{n;@ZZ0)XV;N!W!H{~#)}Sl~x!R+JDv z!~q|4{sD^3cWc}0OTJO3m@6&Kb{iTQ>FVj~8kniWHD+-Qc`Tk9&a~H}bhLC=u3xnr zmLx_yF|H{l&e~JxBurO;qcktDerd-hOBfr(Mk8Yy^2CJd z(7*?Z!NCUrBMOMzfw>C$1yCs&Wu!%EIwe~%m#;C{^6C~IjCzV%zr;2=OnzI{`R3VE zXHT8@!Bd_BI;8{$79%K%?`-iZ1|CHj7pdI)H%J`GJ@=7x(|Yr5?UJ&TB`oUo!MoAN z*BBW9idgTis^-!`{}{=nLiCA5 z;WzlgLcJae5{YyCcYcuSgv^I1Hq5qlS7iBYSVkTGXx9@<2{*KKw6rwz%}Gjv3}1>x zh=ADzQstnKhhAr^s^JSFO1MML;8RRK%p)=rL*|s%;P8__24x~fPg|YMM|y(r10BtUze9#S0!Kz_}Ba%@wtca)L`CN&o~MOzLikv?1oI_#RiWD(5fA#tBy) z9^$f*Hq@1;eZr>HEp>GD^tAMKb@UOKR8i$~H8r(3d_4+<=3pLZRWa3Bvkg&8rAtR} zk?UZYIi;!t+L0q*a{lN!ue;6nYeN#d0fXNyp37Sk|JpNn#HWc*5&K5EWT$hd&zw4TtO3wS*`Q+JD6l~#V8dF42;zlQLqEI$;84=|NTnm0g^-b3 ztd|^DO6+~4eVF#Q(}VSmMM*XkWweT;vy{gtYEMU7o2jCXY7CaCwI$zj4;0?AZEN=L z->}_&H{_57onQf`0WAQL=q8B>vh^X5<~3d>YB%Vy*xktU;trkfPfONT(*^q|?v0xp z5pJW*j=k~8u@_O`xntYqaQEAuo{m?XZk=~H`{#+HVk|U&SR?rW>`|0D9;HbMFVTvB zsi8!?O;Hf3EZ>;M>N~=6+xq}}Xz{e~S(6?6muc#5-^(R}NkbsXfFq+1+7WtQi!y>QK<%DfNl~eFm*uVq8-kZQ z>TC9XePtK5I_Nv1RjBpH4<5VzA)oR1vo?OwUY?#F*REW5ym0c|nd6_OEOL@42&{91 zloC#2%`DT7CaMvU>Hi5FDHEPsoUyv;1N{<7Udncg@kQrg-^XB@hPsZy8=*;_Hhd0` z(lX;Pj1AdKY_utkx(b2{tGEh9sAL;Kh99;Had(VXsmUq5C+h;+XIIY_k}tn zqjw$TT$lZ>+lPBFDw(!F9y;sz55DOUn{Q%beSJJVoNwH^a^}y=XHNW@q);v3#b3Zl zQRYdzK}caw5Jufc_^)h3C2sG1WWDq{IekY`UmUfDP2Fx1d|{>sovF=uuB4QJAL1wT(KkmZ3=3 zGcaRloxb$;MxvyCIQr4G%U^1|?C^xQD9qCfXWHL%y6SM+@z0Y-GEoSUp`cz-e<^n( zH54$4P~60jKs3pUQiAP4b>_bT2L|5<*F$T_yCh|K9y_h6U9TGQwdLxXI@;UBVYWtB z!?alNN`V0ClCO#UE^vSo;1sbmuq7ZvUGa&*-LaYoC#>xaTKiOA7}`V~=pS)?V>tm% zbJy}Hqg%)AmjS26m9PGJ&GB9Hp!Z+*jS2Dc^S|xpbnVjVQy0%1|1MGqOi`P;K%>YH zjADoZi)0d%C7al#!IfuOSN@$47AnNvg!9RNVo_jXg_vy%la6cbkcQ?1&moHxU<=n|rKLjiQ6pA-lHW>CONh9@_ zWHxgIC}mA2PT=@EsH4D>Nq#v#0ENnC*+6@Ka_AO{ZK}8K#ifV{v7TwJ^vlcN^JCO{ z(1`&7H9$xw7KTFL5aK4hA)=>14CurMR+=P0$R%9EH3WTE{Z>9xwst3GuUpp|{eItU z_FAR;xk#_KPfXkYoSG2q@9*d3?%{p?`uXoqojUeifDC#N3yqO20VW6J8L$9o@d8PM zlAP(RqTY&_zNidCao$%;w$<7Z-;QRQ zKxM-(C6c8e6PO4taF0VGp0KJ&NL&$c07Pn1U0D%+1EwX{*r>yiu?bqLN zh@kID6|MNeuz7M}pglDw1Z$(-n#uUkNK1>aL0P_XrliN`VC|nI#zCl8kPS2n_MpQ_ zpR*Ck=fKCtexCOOtV&TM-Z$YBEJP-?gu}4DalLDyJ0r}ezV>2Z*w_B_7bjw)!UO_e zZ!fv0n#--rM}9u_(`RWk;fQD)exL(ZG*VJPaUh8-Mb#&;{T+&!OkE3DesCX4H*MD6 zl${m&47~d9thF_Dw6u3^)O@_XD&t-w{j*|t&D zSOqvjJBa|1AwypMt4 zTgzo(uUg0x3F8@~Y+(JC#|_lh+aB7od%GDtaw0$a2RCDIkWm5C2NI+Vk>HQuTVY9U zQ}**}>UuhiHCmqu@6zMNk={iU-9GU_fpqknJ`tkmXkl=mr?;1@^VKUCesef+;#7MA zDgH#!1Ed95B&goA$LT}LdQhc%>&&-IL7TBF8$ zw|wY%A}KON?9tIg1u-~WJ#DVpDs4l}1xgFy8|{Oi7?3ZBU;zYS8)hA#pfOsEg1aZb zv0A0ZSz~(z_5Js5kaBR5rRNp4|h+u8#m5;d*;NE>vM8I>BR(3R1qk50F+)F{i!Sv zeF%m43&hAF`WNQgG?u$ii(0FftT3CAL^y>8e8i;sai*;0` z5gDCye_?GO-S)k6Ok7lWWK^hspueZ5m-Dsje}4Jri7$L-~p3l{OT0*3%>k=|!ZFWClTx-QAXKl8LP^=|6>OGz#WT9!zOLIn{VcxR@&V*8$_ z-ur0ZdoR8A+@^I)Nz9qDgtuf%f5wx6aH6P4l7N`Y_{!LlLm9quYF()u{nTArIz3lj z)V?r({`bhp=$NRe@ZbP{e;;3uTaH)G9yxL1n;@(UOUG=ktOk`S3jHyQpa2JM`Gf0V zhy+&`B@LezA&CKrz7MGfyWmVW7Wld(daYm>ZsKA#F|n3W7KAb6hfEBl+cB+UOsJ?W zH(04@rbz*W27~i{U260e{eqMwxRap5jYtVD|9w4XNz0e9jP0>A*<_*IUd`KHsK-yA=2ypWb-YJ|H@szDWyFm9By`u(c}!oLHA zrK~L2$`59Gy}7n(-%FyHLmHHht_o*c_6hAplZwoJD7^W-^um6g6fDr7_Eg?-%q@KG zgSn?bJPFC^5Y+E=)gI#THg4rmI$y<4qC{4{9Gf!8riZ8LyT>oZMudb$h6jcD2L$@~ zdb!=Y>2&Jo>EC|sOi|DeZw1@RkcA_U(oe1uH2+FJ4U}-dACj*l@2(5K5t-&_MyX<3 zfULRCkp|y^{=ff^^BrB$-|#rsmbjJ}2ucni>k;0oO+7Vn{qZ}u)WA5xG38*a~MAA{G=@Sp3%iyZVp>11{X$&V$5hztRo%5Wr*hPb?>IJfMz)s!O^mi zAABQ)zMaAL4&^l(VB0{ zIQC;)^nM0w^XSC8YHTuP(XQ~#U9_b~6*RF^{f&zm>Lc$|L zh2Gx2J|4GSZr(ck?H_-h>`X?SQz2D?3aoUQxG@W|lNCud)k!2`i{g^drnsmnWiuuaHisHh+#r}zVEY4glg zeeC3p@;Yksk>q(evRGPf-gx;!h%itP90VX?!ay$%Z#OqjXP4_|e!g<@)--@Xauju( z3b7JB81DBk1B&ROT#;HMXm_ID5Vye@wGW}Jo9j*e=YC;Vt|rH9M=O#E196cX&PSD?JKf%8Du%nv*+qM@u+$Kvl0 zAXW=xh~TH|$CJYFK>v_np)f2A`q%5W=WUPM&bO|eK7RIi9E@PhABqA_1)PW4_x@$T zc|`p_0taq0+ZM~I7Zq?PilWAp?vea$s@?wk_ntps=@hfAvvk2YgaXaRdB!8O7iFQE~VDm;aEjQ&5cEz{(0MgY9$Buh1fP6P8F;nbk?vt;m;(TbN+~)uk8$y?CtgL?sz)(ISKD+6Q zxV+C%lN51-OcdM=3Y`Rk5!KtfN8dF`MJY#0+6e^WpySRD=nyDfQ_d;+D&`UVmHKXd zlo0$7RqFlm$M1jXSx2uzA>b%oec}`Mu<#&%PcMIrk;stXK!LC8RS%aNw{Bg(eCn8( zmM4+2&2fbhd>_SP9p}G=VGkGxTHJ@xj{SdH{cN{i&53zcm0_WY$T0s}gF-KXQWX|& zwhfwe!lL`H=JFOB)E3%?3KZIl3SY~-Uv1qBw~azM`aD? zLto?(MmPci_C&akpp7;jPQ1A0V4x&qFS=KaL%mI3=VQ);mO|*@$ zIvL4i`k*Q1pY%x?Wx_Z-j-8|!Y@|9gUc2Uh~czxg3zTt7g zkl-LeP#{#5kDo7zLf*LT4vl-`=Bcb$Qm;8_4d>P-b4meV>OlqPL*Moh1h9?C7GMt% zU|+(xcdYEPD*{(Q(K_UD~l2Lm=CJPdBlv9>Zj@FnHWCp&o z-@-_yD3gD9dVg=TT*GA3hRr*ku-;;2cj%oh|MU)z3JD7K^9c;~_dxgix!!hjb8_+V zaCN!meCgr(8tp^z}v%{Q19vP>U{IosdSkPH3<)kG$oI`k41Gt zE3GBJQ-0paK|uk&etyD;pkVy-_wo~X-|}$3 zee0IQgf92FP&muQaTH?s#lqI+rw_^dQ&$S7Mw zF)ZGM&qFaR>xN&WRCW1CVyjxddhYz|TUQ{TMHYYJYb%=!Z2Y_ zPzd4{fq}PO+&!GGU%PQJ;bDEI-Ar4|3%r$Q%Zsif4ozw5T2Ex_qm@ePwW$st z>Iy<{xM9P#_bvskhzbo000I6!-T|<*1%hCqz~9%~U*PHC>2dS=_0#Zw9#pGZ%IK+< z)Wba8j}yxiUNwgXHn*^{;;Ls)?4sBdH@|Z^=0(kddQH6S7)sEUQ>!^w=rbw?CL0aR z4`D|h_2tifbMC|k)@E9KRV`ARsBW;rV#klZ(GixRAp)=4KJbbI1c*+0`vnCB3;n!( zJe^$KZeP1~$z{}EQS#JGYhsF>EQzz%Q+v%Lzx>7;Ikkjk^Yq4d7IM@fj+T9~L<&~+ zmtlzywW6&8)iA5!{uvi(2B=LkOCs7|p= z_&?13WUOsKy|-`)+I^Fh%v77q>c-bnCaa9!c6!TZC&oBKYyF!)Tz5bB&!<;zwlZ6y z#baA;T4iOi{)0;)F)`tSWdXqGBZ;neN`>vm1|a5yy75?3PnsJSS3IZ905~5C|Dk95a{oR z=urShiI1DJvy0PJ!4PCYNkKi_b7^B?@a6Xoz3bo;U3U2&k5kwv&xpn3+xfq!_sV+* z4_3Q8dHBN@?auwOe7V&UMe)4Gn*E1=4oDH)aM-_l%SIGrZO}6|)#YkEb1phEJTeSE zQjleEkT5)iOnJef0v~@tNMJyK7fcX0XQx{?uiioXN*2`7x(h>1?W@~2 zTk7sT9T6KXiirw|4E7Jy6od#vgB5KHeSHH0(UhO6ueaxI*BegPlIE0q-Ph7a3j^49 zAnw9@pa1D`)zRN8#p}oCw;7{kOiHcSG+w%X-|HVbdZ#rE52U(%uywWOnr+)2e}2z8 z>vg;AE=NX&#>9#clM5C22P_Q?3K0sS0HK9^1IR4t6Byv*;da~k#^qp?i2Ew!y@ozG z(<7-Zt?)Z@$vZVOAn1($)wrK-ANl78Z!NXfwK6cYG+Jx0X3Lt#55MufqjN}U`@K0? zrIY6-8 zUoUS@=bIi~^ny&;bS?e5oF40vR994_B@2ZW(}SIH1uj93VYl;6`TzFIiSNGq?2jYI zZk#yp=@gz_H$bfU>AZ{Y?=d%h{fnn}ZME3(yzTFSF=2>7MubH~goek22!nzH^#g)1 ztp;P5`(vE@_y_oS`3v0SUYuLb_1MGielM>@>T0;Tv8uehEGr|kXsC;xn(gi_YmLjz zPW2b%M&$^il1tkL?qMGgvS&i)r8jphH(qM7ard4>pPsoLpB^16N{B);@(`{tBqTIA zG)ONnG$b^{KR_7f4=v;C@8jv^5h(ZM+;)OlA@^SFZDiQz`Ch z%waL%9KA`lFgZ2WH`UXS6CZj0@SAq_$9;s6Y4M5i(IUj&qN5>90ii-+NN8AiNLXaJ zHca&Z1WH1}g(1R#;9%bXxi{Ox+c|B_UC~+vZ9COnS1A^kWQwpu3%0GuEzT|}$SZ28 zmo)V?jkI+%78EAIT?z1Zb3T9VwlF*`Gp#ryFau7&7j@K0Yp?V+aCzDw-^(H%>KISCp0Krluw*=alA^<(K7E=jLW6 zhbDw2C&tBur^mzy{KA1NEG;K9w-9?QrkW(i#)x8*;$uXR7f}?3W>i#UOn3-9URt0Z zBn$|GSA{v#R{*`_rmnVy!Jo|r~T(36rA5@W(bf`k#Fuumcp*$fs21R8`AIVD{5!=S-G zA8&V0?-tj^?j#aAh{Zf5r6uC5{Cqq%uP_sB=4Z!;r4|$vW#(pPB_(GhXJzEbvzX~A zN%Az)%+%zR)Z~PO_^8O}@Q`RxSXgMdP#7AHAiaT~kDrgfFd!s2AXwlV;Op<}dDF9M zApx=ADQs0Z2Qy9JfPKT=GSMyx5M#$!DOpqFc9d)^E|8Fmv)I{?#8#ExA`yvNPDQDg zNaltzE?S1zA6uH~W^Yd`*5r_#15iywcUKh^6cyy>V<)iejQrf(oV=9uoE%YPYF1ii zQhai3GI}T}H6=4GH9avgDJ3m61-}#H<6`4tVj`mDF)C4ziI~VxFHb#RPj6x_!=?&` zI`j1L@$hPoL$nw95)_WY=*MPjHUa_xm$1zWk`H1m&4e2Oe-Swoh8?NiRDMSi_r$j$ z-@xMpLW22(tMNuIk{z0llEny7!3j*W$ICEuD^XFU52?# zb+j2&V?}sYt~`5ZMs{XiT6#))ZftCNPF8AqYDQ{8Qd(L@T1sMaTykncY+OQeT1HAz zOk`wSJm?n1#zcr>!{s52&~W`wVUWKcv1$W?NC4X-gsi)bS9Bzyj?s%QW7#^o9YsH4 zvpiC=gE}&M3L7aaGQPbF2sOC5Ig%}x6=<*nxsAO&c4T1KC`x%Ay&tDSitO#NVK})( zM7Tr3mt@ay^pKSNjh!P?`78y}mmp#bBel6{*rg;Z6Z`a}rej{xL@d@-7_>s7< zw`W`@c4i?Q0)_U(?}AT^<*(qBVgqDC9r=dH63N}+4oAE~$XLB@){9U{1PqBITvtfp zqxWMFDgK_kBH?X=<=g}&c?ipf%p7=*y)|GK(G~+GDQW4cS?K_VVICiwkQOHh2~S8) zNk~f1%+Ah`r^~YpQew%ssTe(?P-65%L<5{i9>ar%ML16wLI=wVb|$`jfKz$vqo7cN0rWBwP{-312L?b; z1qwu~=i9T>5)xC=(h`zWQ;hl5?1FVF>apn7Lo#eMZRF0|A&CU3dNm|Lc)DVv2{N-m{Y(aO+Y%U=t6qmOdZyjBqTuv zBt%DqMMlRZBt`oL#Ka}UB`2qopTvat_^2pRG&FQrNJJD8T~VPC(a{)b&<~-QhoG^8 zHG%@d0)qs8eqNq#9$Dj&O4@AZ(2B+N$6)pkkBLuC68Z$E z#Kgo!#>Xe5WW*=L$HDLnj|zjHj*1A6j0g#dz@4Fycqa@ChUXa&$PW?(cneTX;p`gO z7!J~qxW{jq^(;+JH2@Y!JHZ0A0i~fxek)d|f(n9zgGi-RKnC5T3WMB9BAbMD_hCpN zW=EAM@OYq=*w5Qjj*Z~YW|@4ZC?+%(y^W((Kx$M>Tw-*9cWf*y5S*@(7#|;tX(u5z z6n+Y9T^i1-5iGsg4p;FkC0em{YJ$> z;6!o26eAQy!mC6?GB_*}PES-MOgKdH1AwXNI2EewG^I@aoeRh~ z3UCa(i0oxbs+d8qa#A8+kO1Jr?grPSAPJ*QTANJk?I?Als`|aQigU{fW1PB`3-J+dN+AZ$x1|hfx zl8_L0cQ=T;ySrP*-IMOGo&=aV=RN0s=M21S-L>vr41@`t?q^%=s@k>xKc?S~Kwk(I zAbbdf!;>Ir0CYc+E^u>Q?E+DRlYicj-?tBjrHagF#AlI5CJyqsFmr|MVa~$j7-TIk z@O}oBcSwOYoC3o>zBDs_yaGwW{)ZMI6{YYl@UAPMAhy$<1=^>`3lRCft+UNBUj6~0 zFbe{_`~qN-fbYnRVu#+2jtvV603XZK)zb^sg*R*$h#T(Z4Snw8#1x1B&D7YC9`yA{5-C?= zfG`_SrhpQXN30amrHjLW^d>ayKfLHa&VQr@z+VB$Dah-?d%*7VR}<1$AZ5jxX^3)n zae@FZz}Fvgzlg02jf{rK6PkkrVeSxndb&EexH#B5!IW`whvb(#vKri-ZR~uOC)H0a z{H+B53R!tOViZUQ@M$2*vD97A5~N}alE%Nm8TauynOFjbbq%6IE4J#E9m|@KioqXGeQ0M=w`rXD0`D2$>*oa&>le2+wI9gABvc1HtE- zf&~;prpw}#M83ikE|qA3DZHKh{n@`i;?gUYQ%C>h32W!UMTdGK__DY_V_D~W3!`mZ zt?iuLo$Vd%U0~bv_3?7Fceb&#vNAVyws&@Rb8~^P!O0COdLe{#c2B4snPLLzVd-hc zkjrR@xuAmR>R*ota}k+^)2#2B?^Jux75venZw*;|6{tJ^aK>SVAm#=}012r~!Hj@u zqMCxTU;-RUGFfMs!<8vM4i<1$VFgKZR~I-&vUjqww6?Xgw6So2goTqMtUgbBXUEU3 zUg5dT)AREzV99kd!KG|MoRNYc2vHW1PUWB_eR7V~Q5)~?X<`4_$=bou$-&OS$%eSKL>=CxrJ%a@`Zfd-m>3@H>t*)r=l)fYeW#_l zxuLZYu$ir`-9007v(Ts?^w2rTDb518q@U5%*3w_!lvk7i(NBQA)#rqY`rhvD`ljZ( zO3>)9uWxSa>>Yzvf2W-yeZxI7Ix;fc)7e>GoEIGw>*eKW_3EYEgX`Q6Nc!#>h47@M zAO&7sS6y4*(%Qk8ivHFMEb#wk#`_sPg9DA#sZq%hpG@AHzf~~QQhWSV{PLl7$BtiA zw@<4o$Sx@@FR!YrZfI$5?;eCQgC(K_{A^}*QG!a6uUF156K zFvZ@0a^}xf=M_EUG73sc$|~#X>*|}ETiO6T@`G49zhip1w-0EOHAOLgKA~aG&H>RS z9juvo7VwXNSX%qVh;!v39<6|a;=}z6t(0e1j8Ze{q!w51LIEnMQy2seJEZcVXS#U-Th%#3^o zCf{JC3lqS=z1GrLoE9CGS(xOYaGz?K*D%du&5btJH`NZejtwu&vsj73>yL77UccdMmk=7t_9&s=&t1XemfIXuW{x>l7Q5t>xllK6~x@1DBJ6Ql6F@<_`^ z&kdjI7(TUlX%}DUqWhJpAa=+r4A0nj0G$V$_#i z&y4s|&@oY?e(UbtJ4%9lcO)pZd$$F6g+$O8F)=|h(a6};LH7Qco!d~W?|Bu~Hh}nQ zTVrirR$+a8>&Oz~<~?im?C9ulYjak@jhGBbzcX{Cu3kEE^8AH!*SU{fx{sEXl~aE7 z(%R9%^tGP4vC(Hkoh!R{qSol;RJJtrc6PKi*JP%bG_^L*EFpVQ=zMW>_06cDk*>#(=z_x;^FAy>=_su9TVYW`o`GM$V~n@_23G8Y(aH>Pgi$) zM@v~sVrgSd&wR>a_kCcYrkP_an`#PTf|5}q3#_Y_r!O5nAwpL%P&Rn)g zZSU$C<{uCf7U=l-?aN0BuMAFzxx|;YcJ%gjwsqHMB%~J9RgW`M7vB<4rE_DG6P=(I z6rbCJIH1fDfgOkMk+dEg7=M5xVh<;8zp(h+g3Pp{{QT04gxH91A4~Jc>QA&j+4>i@ zb@%r7_jEPnq{U@aS9Jb`DxDjfnC`F3NQ;SW1KV_?U7VBS6iw^#Yg2o7FK4&V^n#|o zkr}v-GYb@qg@LK&!b~{${Pa-L$tgIevAbtrXn@g_4GDze`l>Nz+Tx=ksM7JV>7lmD zoP@AA#=aB}x>4=)F0@8w9x zzzD+9*)>009~0oLuMt<#)CM+lu&b>iG2(?!eP#9Ze+4WxXZ@O zv99Lo410-Z04#0&9WSZ%@R@~MfL}mD-5f$&VX?+5VjQ$RtJ=C4jK=Dw+7eq7mrH9& zjweEMIQr3*u2lf#|8&4KDSida)VJW^||KH56_NBG1w&H}S^y2@TVwxzp&xUa3T zKJPkerBPLB`Pe^amQIdLO+b(NXmfpHu|jSf{jlbhg-2LWP-fo(!Yuuw?b-~KZBQ?4 z&4+qHe0^o%PcchpMkZ%Q+6E)}_lVB1vhSRuy<2VT84?s!w#Y1-rDGG56YcG_T03r6vf3mzQsiYg7WUOl#`?~V&Q2w` zWOB8=`PWfPftWfmGBefN+7X1^70v3`TYE*`)Bb%C<8SZI8A3NyJa@et6#Ms{Z z>$0$vabTDBIe51)7)_nMQ$|n_xI%WaF{j}lvP&mMr)Gd%>Ua70b5`uW71z|9?Lwm1 z5)pPOlQr}?rhlNXqkCYI000)CRUMU??TZA_pT(BWjZH7iPfbn`R|`ev9A0~cY-bY^6Sasf9kVSM z9~|oK?T!a*>7hN;;imG;uAj%2PL5B_kBzW=m+jO|Rs?LRUQoc7sHz3lBDS={vkU0u zU40B$6x*i#sON(nMd?F7g)N;K9-o~X0c`0C;Si&ZC@zur9?228;MFaDUQ`sgX`Sue zCD)fN`(x#wiG2;_KaDMQgnemre0m(9w?0CP^WVvnrF=IO3PomVw?ii@d7u$-`UH~TV& zH+D4l=W?Jn>|L=;da$iL1-8L|WtKXD3g`IT-0bB1z&+GViOib$hAf?l zCEI?>o!lU=&-FUZoFp*hz4)OfED+m!;({U|P_kCxFv1>j{@vHnQS zm>lZw=^fBtzaM0KQQ|!jSNHu77j^$d-c-H|~fJTZh_0F*NWF$pZ2_ zf;&ZA9{c9u{_f79!u=}_LcQYpFWohHQ4N2Cl@4|T?{jY6{Q!#ALtMG+q^6cdKtTTt z;A8)c{yNp)-_95}M{!&M^Ky+*U6`6Yvg9WNt8|tD=-KJndJxx7_1ccwCimu{i+j#I zbBR^jXV){>+uF(~Kfd}X)UmJj9xN|PuK9~q3fJ@Idj@9a0X+L+`SMS_6t-2jKIoa- zhQk&(%W6Qb?=1w!%#HN7b&sl{PVYo*MBVPLsmx0o{SUa((T=g1*{S&gZnkT~ZaY!O zHQzq7v2LD%HvrC4t9>g#xVtA~m#;do;rIP0r{T)7yej5W>;SmZg#kd)k0ZQL&Vby@ zsNe2u8Jbyr0mRQDu5>cs%Xn{3&)^7+ZNvUGYf$(4dg}`c$Cn}*4;Z?>>A8u4f#}_< zU-sy&TgEP``Pj<23&EAvvvxE(b@z2Q_sxfFUilj+uWtA<1els8@NSp74_K}9Lu1op zeS@v4Y}nqY8*JN!wRJvPl|YgKp_Kw>b}FWJX0W?uxbrYv7KQG=Jk!xxSM+yUDX`>6 zM;M)h-g|zJ>lfd}c2!L6jpYwoDKLr>Cx-fayC+Omu3iNym+PX(+d2wb{zfaE9U2_z zYilpOf|4Hg*vz(#s;p!7x%L~av^TtSVsMZ#TYYfZ+GSA7E-={LUR&~aTIoDY&EWw? zeSNd<>$9-p&&c&3B4>P()=gG@gomE(eTA$L>RF~8J zudGsEa1JH`HQv+Pn{fO$?@5{EYcb}=uPto5zoAN7!hu`cGc@P4|F@NAPQvx7(Wa)N z8~_>qrKa`^P^G>gv^?D1$6)lgYogRy8Jx?{yshjp;l}@ zw`S$GwEpIX?5*a`p* zme%H0R+N_IRuq=ymF3oC6vm`S=9Dyj=ah!@&PF;;dN>T)Bau_|*2>6>4~ zDcuN#|1#^(35k0qAWz zGdg~DVsvD7S_|YKUhHGrlrquSP*9Gr8zX)_rIf`y4Fu=m{-$bReKNW_I$OIK?Toe- zKnWrl!Lov)(z2qQg6h01kb|!)E{Ff|N$)kM|BRhP${>?4ri&P+N1RTB_1(Kwbro(Y}jx!B;q}hPr}(3#1fS z;t=uybh5gsy|cZu6H?R2m)2%x{qkA>eKKnSQd(Y=mz$lRpOKqaQj(Wnz|2SGtjUTE ziEsZ7DRmhbWI)o`0JZj}4HpWf#u{oVNt=X|t$!<|G>!!&ppc&K?Phd#c6GIOb$7OR zbhI=;OFCK_YwPN3A(2~I4e$Wqd@^&_<>Z%^<>%y;769#&nazq|i)ug^rEbv!y=~2d z@f_<9X}w<0wk3bEvnmA!0h#B>C?Mz9i(eN<0U@mZAS*%j2OPV@wRtE*fDwX&$PGV$u#Sqf}+w()30MXu2kK2CrS=FUwtMx#gCp&YJ$$-cHOC#%FAO0UA zO4lP)LP$Pzc6D|%H8nCDSgjnL9kp=m(Ao$X!OEg4uq&m-l?^#fz(mT0Llc<*P&`?q@%UR>CZhEbNx1dnn9$_x)Fn_NVcW`^|jbe5LYitIf4!d;kcZ7{2=CM##^S0hT3Sl7qf>YEvT z{k`y|rn0`K0-()6Fw8C~uB<7p%POs^Y$`9y%F8Q@+6p(0(g?>i6|JURM@b$K7O7d&7N;507(<<^CYFiro_rcBh)sKSR9@-@p6y_A=7w6}! z$N{=x7Bg*SdVZ>VQr8s39CKd_hMOy!+j58(&@Qnz*R1xMZm&+yo?3ui>)(MV9q(#t zW(@Rpb}^s{^=0X4dF2IVIjOnveksA>UxQP1lcM~RKKp+34{OdojaqY7KrJN2PTnag zqo}m9v@|DoLmmRF&VhRL^z?+#(7r`FDU(&`-8a}$+g@jK46U?a#)-nr_t)n|cK=d3 z>GTkobH>m>TYV>>RqKlKiu2=Q;=RM0iYo@wyUQw=85L>OjGVFT%*Pg5PDi$o0^$;L z(?YzmVv-7LYN{)8b2b%~w`0yJx4*xwu_;NBM<^s&;I}_A z##$;8lYcFpbbcIs?C!3i!LGX6y0W^u!o0E=*SOS}>du1Z1Z!(uNqrSn0U>d;xN%ls zqeJ97N9nir31ua4-=QEmJiV}@uDqylQ#nw~@?ae&LuGSHRA2}~C(RBXALwoG$}^Tz zFiU&19i_6ssLzdP|AlnYVVLYaodW}%^#CVrC`?GsODpP1baj19Q&+!pX`+C7eQ z+$Sy`I>>o)Y7T;Zbwnan#S6y64QSfos=IoriJmI?!I0?7!TE#6j#^g#3hwfHnpU_ zl)QiT9`5xEDoI(QqF+NzMqVq&1&6zGci-*J8*klU-*K5B=k^7RW>GfWASq}#S(=wy zT$+!dZ8HEPmmcpQG>8yxmbdnA{yv6^bF&kN~lLd2>Tg{l6Z=$`)r zI_U_2D;Yig-K}K>HI?~si4~=JVJ~?_`L7De$bDhGR?}B}%t}&LP?GRr*(=CvQvz!Y zP96qn)_r@Ao>a=nPEW6_h;oh0J5^g%S(1~Jn_rZjm6Dj1nHBRP8cH`Aj$QqIumL)p zzK?14S&2G5FxXfYl?fS@UqUDC?nJzq-mb>7%G#2oq@2v)Px3d8Nq;g_(btmiE>cxf zm-C<0l~R&Z$Z!_o4Rf3=5Y70y9f?WOABv)2|`KhcbV&)#q zNJ&hN_OY#)WkqESHg&Z1mh+#+CA8l`t#e{^RHp)+6w)cs|Gy4T+SUX!sH3a3vZT5y z<7-@y<6F|Po6>4YtdFYdDr){8JZp<)nRkj3njh3grwviiCu?&j&-Zo zZkJ8UE6C4C3pwtUT3lRPS6!N)4VzeUVpLd&XKV+hv1QQm$OX-g&udqshx+UD zgGzrjo>X9_tFxzv(c4jzTUb*X7wq^5b447l^iW@=pu<>C2U;Sdq^2yRC@Li*E&fD{ zCL@ZAWf)+^#mI&u#g7R*oS?O}0`FXzn~_<3Jj5>|8(^`pp0jeZ(=$@TyhEb1qthol zTbnvFP93`DQ+XAI3Yu)IObq$A;7MCryLhtoe>as&jp3;wVO89;>exhsm$yi6( zP{&YPUrkOyQ9)WtLRyL@DJ4k@U|EaM#ik`971zT zN(#z=rIekO8XpEXC_Fv-2V2_Ox(qoF8Vy;mMyU_Ur5sN#DEaChm{(d-SX7jmlaZQ` z9v$lbF{U1{R1c5rcVoR+x6EX&w=pxI;opQNy*%00+`;Io%`B`dO|_M|h$Cy5fw-!c zj*gbTmb!+fmYRybrV5FVuB0q2Mk7mFrB$lmMl0~+?lLJX+9tXvl@`+S6eB8r9PUmZ zev)!DCn-BW!XYrPycpp1xf$u{SxGTI=Fd_)n|;r1qcVz4q0ZC}ww8n^&p;jMH;JmH z>uX4G_V>W;e;E7xoui1LNn2Ywn)(_G%BpjG9`l{LM^<_9R8v(=LrX_jS4T@jLtR5n zMO{uF$B&m(RFWW)MCAwG)5GGDti5G$BpQ`MCF9kxLUgK_sOVV~=h>G>(y|jWlDzF= ziz*6A3$rt`;PPCIzxPASiW>Uqi-~=*D}Hn8ZmCZT{CA;AcTaZI_x5zv<(F5c*eahm ziZjsH*HqTf)Ku5d&|>PaH20}#sH>_dDM?Y$LgF$qSPl242=&-bhu5hoh9X1~l}TAo zCsOECoR|Y6e)sB4=Z?KDPmN4UbaP24EiEg_feVePvElyS*3Sb&j_fsHrEf(Ew>CAD zhvh&D9jgA82I+6S)&I=#{2#>De;=eu79Iq9o9a7zyUX(`%F<0#FC3M9`A}U$T}x9_ z3u&09mZpZ5s+yXHs;ZK#Jb_O{lKcQuS0+hD{4-e+mVm>Ph-3aThCpPPh4 z<^KRp%F)%(J=j~3Uz8eeFD;JMHCBPKfi}T9S{yGmb#+yy8cXG!$^&$>||( zc29S)SMRv3>XkjYe>gqAuD zN0CCGK^WtWv49vyCDkx^EdUzC#z;Y&uCyQLoweQKJ7+7Q`TSD6q!S^t-|6^s|8 zZ1;s-vkk%dfolo21o`2K_TQ>DH<44me#eD@w}^xP3_c z&3i*-B{inXDphEOhL+ZX#vT|Obv0FG6=ek}1!}QB_uu zMP?WG#tl2qT)cKk@csidMoh*RfbMT2O!=EeMSe!4U~03I&go!;=UU(L*9c4wO_@O}wkCrGa~XHDJpNic5G&Lu=HY3G8zY0&v1(T|`A-5vCs)BqH<8AZI@R89YLv;lOFi=X+8kNQA zg&1QMmI6zDubh&U0Q%x_Ze9uLGwesOM6@73AD@7rFb<0+5J(F|7HI{IB8nA0M3%UR zIv7-%=;iG2R>FjCBuFNTKQeY<< zzkBh>_|YRnLk&d;1QeM{EX7O8Dr#yfuwSaGslY%f$ji%;1kW71LBiYs0NgbKUVx9E zUqBFpfl(piNn|pGM4)4E>Msrk*E?=rW|)^8WaIK#FQllX6l_&~c21i1#gBfzl|A)I zaDnoFMJwGi4N3kYU`IfI?n8G-cdlMJ#I>92HV*TEhlfvqkB_Ee@#;Ml zBl#w^t+A>mjMGS2g#Wi~o<(0waR*Mni_Xc<%E?Ym%}AB`Ln^@BsW1rpri;}isFJ2OZg1a87is@O3I3oMBLqz`|lFZ z^P{;B@7s0w0q)*C9)AA2dg=86p=F_Bl;j-iHwFX}2N{EvJHEo8GQoT^>JJ6q)U4#} zY*2K_Qd~#y`TWV>w~WdB&Z%TFclLKR=>z7oBnpl6pHrw4+P+u6!kl87y z7ZGLmDhf(6V$@qZ4-p7gjvqL3UV@K0*BKO%&Clp!jN3n4le*xHTYI@4oDCK1r?Exli z5jM9pEgD%IbDdqKWzDgz9_*JCbrqkh8XM^w7#Qlq%+S+TS$qhEdBu}p>)=_G6jc;u zWF$qgS9WmY`LCVd$8qp52glJ<*KggtMU8hP$QWcY!-*t1Q*@bxq!_#Lo8;_gD-MKb zIUfP}EY;xjteiBs`5!5UI_KwVZDVd-`TZ&O54P84x8xNh9{rQ@7@|hK#}Jq3>+9+2 z>FaB&gP*}vJPUs+FIp;Oipa~ziPFiu2Y211+`4sf|Nh;a2iXsEpS^kW_LY}DUqc77 z-{5gnd5vN>Cj4b+_lctfDILG=Y6;a$w)TS$+;&U^TR>+R6)z$) z6&8ttytI_GG)Y)W{Oq1{Wc1||2RQca*}n4tJNv%lmv7(Wzsq|=SO5c7jzSX^7pI9G z6eeSFJp0**B{7#k?TyPY2@!BfPH;NE_P{GQCkrcU+t9JU;Y`^Vdb`THD+AM>b5dA+ zW3^>ZWghG4>+0xgYpZL4JFfwYMe)?)#8pyMRze;}N?Zu9#KV4^PmFZ){K38Z_HF-T z=Rx+}TxV`P;Nu6sUYJ0Ja9NZk#zq%oiE~JZkx!y-<)vJO!r4tSUm%5+6!Z1f*(2wy zec=+NjlFID52)$E$idt=H;` z@D$oQnp)agS`Yw$kEx<8&s5-q5kl6nf~<_RAm!oBgBN&-WPux3Pw)M6+wMPCuh{y> zA+F0zzSTk^BCxrVNKDb?;*wIdLo)BAwdfSKJEci7P+hkMXP*w!CDKdw)QZavL9Vve z4%T*-Mc){wZLCvJ^VZ(f)0Gvjx$<{NjA^T?C_hou*3s5fgIEhZc2zJW5ELU@B>YlR zW-6VOmnI9Uk&m6@A<1FRALHic+5_C=&6{^@*~f8?hYyVr0oRK}rihD)ic3mr9BLdK z$S8ZX{9I`&6_fxsQ_ZtdqQe4hNPD&ldj`AOTiRJ!Sp@#Tor;fFw=?SE?730LbYvB^ zbv1R2ROOIvQHAJ173M8;3j6_P4%vbf!Nf?A2`U1o&hZE<844dgbn?Wh{oA%~*}b1* z!%mL#eEbkH;URb@(EPW|i|xaL+b4bKc3QVKf!E@vmR=+=j z4A^-pYz@aOGf**2LZl>$(pF|ZLAET%WaUUjZN}X*HBe^sv|2dFDIwS zR9>s7B(ER~3tLuxL6NC&QVDKTJt3Vv^FV~E`9}2E;p0d5?K#NFxqsU(_8n{44_<@m zLm*(WBpR7S6%}LBQDR&Y@Y9#CFTYXje-X4*mkDav`}&&6o!M~ggl3qZy@$2Q2MY@` zleGU5e#+He&8W_QboJ^^4MlA^2{i~npP8yj$w zP=q?`15gtAo2bO&kA|ev`!;fO8AJp)x;opNelRot=rr+50I033{jCjcg44bT+oRoybg6K7v=n@jLGIFX)^5U{Qr!VlJNpi|0Au&PDy__5e zw(n)0DufA0N{1pd{-}H^T65g%mRO2G{z?Nk*twH0M(6e)QP zWl2#Qg)B-E1#==Qr)r?5AZYNzjRkc}IFCW;!CyER!oRUIkjDJLC!c+=q_rUAyPfeb)#VSI{#z{a|kP z=55X|L7`q4Xn+)>F&EnwB~__sijXBmf;}BIc{y<`-au1LSzbz7N<~IdRonRa^M`W6 z53b+5%ZsHkiCj02pS>=0=iv4O`}gkNw)gDCO)K|vUl$Ta+Ji*0;17t>=@h&iyZU=G zcXKY3QHJoE^M?=Ymk~I}$f#i@}2VaryhlF~0(dD%sQ8R+U8CiaO;K z*%qx0VJolNS22}AyepdDqU1ej85dj3SiG({e6p1=9Ts5u5s}y@*O_3 zWBc!0`7emZguA$UIy;$vwD|bm*e4cBe14XTDmCBP)l{5v?oSkDyf4KCwl~P=s3@!I z8A?ma$M*oIAL6^EwXtDZ^ktgaY97 z>4SyoyC?2Yu$Ks@MLz>bm742fl&AaiT}0`bYwIa0BLN}oj!Ig3+7dKbc?r5OhDwtm zNzlmRc$ydyOC-yPLuQ+D|KOP$_bzfBy>R;)=iWVk>?NFCyWxT$uaF=H4VhB{l}e_P z2#`GCC1Z|}$ikX07 zRx9}n0I32qovlSF=G;d%YOAR#K+Xr&5x7LM^71l@>N28|($Zua@{mLlfq)~3P^EPZ zXo4c*n&^|q&fmIqg6sIj8hnuoaDYAA?5olh8yO2~VPkN?B@Z9KjH7 z9o>QAPnYKa&ty5_G2y`#_KllFc<*`nc{zHxJ2*I*eK33f=3QI-V)p)5F;b-_8*7VF zwb@a7RJ0aPQdE`Ilpu&#P>@nqQkALq-@h=-~^Zyz|!!fIb1L zKL1ljYCCJ=SW|s&B4H!y(nBdlZ6!_h1!W->1xW=ZSt&_b?Pm|w4L&@5q;K&0@h9uo zubdtW2}(-eICC2(&UcdI__=E*c5@s#dt%qE%YSS+tw0jw6Kx13U_)7BIR?T+3WX#h zYU|s6w1L$mgIeq5$+v}VPm85?RNR3W=xggy?p_&W^Ze8 zmOI~V6vb3V2I6crH95_?kqE(+`9kXD?_XZmPEkaS5`9?c|4)aV>~<_W1@)03lWbIP90sw>1Fox zJlmclXWgGYv9s5>9H%Pb_azKu(cEF&tUsDso4RMZ@| zA)2=ot2~pYlOb#+UEMT{Kn=2eo6;HeYWgzy&*Ubv6rJ$#1e{O%q5PKv0~ zL`Wp0O>me?!4uE~0$D&pEudk3H2(Eb%ucpHKDx(#!5%)y9USx8)5nUM8Hfe}O$4_B zYT$NOpI%ygFfsN=8uio2)DD)w!f;1!d?XL*H=>HlTR8nwmwnb=^QE+0-8Mr5N5K#w zz~jTwi9~7Yg$qP!p(}UkqPLEmxrXIEapVS(c>Th~-P;eIc_2m=CXko}7Li5RL?V(% zcp@C=qJ=RsjCdSdqR z&68lzMfo{m>fVv&)c6R@isknl`|@BZsVgabt**@fK$K}RA(I7|BDe7vJ_=n}RN>yq z+u{;D=h1ZHIj*z!1aBVWrPFR5KeV6w>H`vufW?uBa0Wtzcnd~~M1Y-|PAA~6X;?TN zyU(`qv19yHRl-w^;9)1vXdCH{a?!B3=)hovNapS3U}LKB&h*Wrh*@M4`zdlN|NLNQ zaz-d_4N8<*{7DTldy>je+=_dmjp_p^R5UM~)sXlFNklxIe&rNe40qu&n#h0T@Lf6; zO%^zN^!Uk3cLWF&q!CQQ`lTkp+#?a;TTJo_5<&R>_G4?833vdDus=Q2yRpS8ApCI% zOY41HWLR*hAMh5ysykXeeEH$2P8tgto}a;|!Wv=@wxp+qlQ*#OIvOZwsLRVdHImco zt}h&IX1UVEiG2K!QNRh)74QO7p;Kph2?AW#<;8Cu!>KD0Ax1fU{jLB8Pln?{NXtMT z4WfI*I#9rV6Y&^4{6*@<+9Rmlue`G67Z?RuMUw?Kq4t*3c|x9XAl(`g?Ck?W=%AeY z?)`^1+L>RWIpYXuW>L=We@jtiUl{3#kB(D2$#zypR#Szl`nB&hJ)l=X{ZWRyf`pV9 z96&Ke4&s$HWUxBQg2#FERfq~7-izO-6K-BSd*M1SUI+&(1*RFExBx3>CD;QJp1eR> zLpIhRqUp4w%a5Q09KKGl#!BP!hvvh41K*ajUOkOYh>8HMb&y7MbF;Ow{b*|P_EFK# z;#6T=+9JK9&Csj447B8xU+0VjXvlhunW@w1^5W7`l5{+pUkJ(>Xp)bNUaAUdTi8E) z|6D~vkmualOLvGb4IpSCw&JB_0HSTi;8 z{*}xD-?*SaR)n};4DR8F?vL85s#WjUa?Z-(_OhZdrK@`Kwa|aGuh;pVj%Aynk7VI(+ zS~5r6f*c$YDR9azESfbi}WvleB*9P%?%Qc;KFFDXb4%gf72OT(g}lkr##fhhg#ygO4x zND0naW#we0B*dgdsZ=5c!!L}L)qQDU?&E3U1x)(akJMl~VfhrEq6OZtEb$_+`oR-` z;ej*@nM@!EfgeG|D@g4}?UDMlwGu=Zm}8BNb940--3#-kFJmGjnbBLrVdD${5P^fW zt;ItVlZQcY{Enn2egR#zoh3D0m*?Y@9D0#$r-YQMnuMCMB$C8eR+5*Mm64Eu+D9rD zCq%w4A}oj#kY6Eyr((LxmU7x$O3 z30mbYfVl8HXspdOGMKCa1z*q-j*bS-4Tzlk__#nM|HbBA~s3> z57cc#bs6n)FGVF7FlA*qrpyCr2}lJIh`!B1FK~Ar@bdBV@jpO6;N!V31pAE8qnZHk z^13G`a|R+vEf<9X?f`5#WHQ=fp#2S=t_#f8eUFnT=iqk2e$XD6V|73M6dMs78VQ2W z0HgqE2iR?R?%I?o#tA6gJCfEHp3Y!<>oVMk`az!m+OXpMnLk}wrq0N8=Z zWF~DRS(xBEHRUDBw+^*YK5B|J%Yqsu(4bgwc^4Dy8x$5E9u^h=8s|U{v9q#!^Wo#O zPklcc^V77|!HUEW?kQp1s10|#$4AX1RA4PZg~|yyO_P!o7o{jLGSp;hA3kn-3df2V zAt7NQG&l-a48FJwBg~i6pb|E!D9j`?Ni51%9Hg7cWI-XTo^;AK)JC!|1N3{DQ>=Z= z00X~>ATLnbj))BQ1f(w{SKz4J*v#@-@UKL!^3OG8&3;l(*#9g*l+Iv$5b${&THf=CF;hpICK1%<5#(8eq~$o@fez@%;^tBDJc zU`GA ztL!)))Vi~BD#}!oijNYCZ~`L+CrXg0=OKR_9T~ONUw9@=!Qrt4s7(_Rci;76Db*F)ide0L}{dFPgT{j zS(@%9yO4-N=NS_9A6XzfG`dxEI@trREftB zi>Ja14L^f-N++W~_6>hH4e;#CA7XpQJBDHVM1(Zgwi+mb1YAI1LC`Ev1-u!tTYUOE@w3<9W z&yeZT%YFPR93Lxjh2=qq{> z1UwcF(V^y4go!!9Cm;l8C~$a$M@v_Ys$6$7m?vBphc$ZF%r1Hp7{O7A7gY zvMf6|J=>gSr}iQ|7Kk&zi4F`2gcg7!=H_JYxz;T`ONeCBL# zXJ?Z2^9WYag_^Ij=Vj9?LQXD2aq+z#Zjl3LT?7ZEI3&Ih)+02O$-)YNZwLutU_tPs z(MTQeVzN)@(L}2}7+eABmw89@NdS*?8u$e~72w*n{{;8BtJkkxJtQM0dqd9)$P|IW z{=UIs{vLo*^K*7_b$4?117fFxgQX=Las4!g^~^|tkMMyR2v=xfkE^(Z|9Fh~&wg?RW8txA;U;p3;Addp%5jZ9Ou7HGdb#b&aNuB?{5n1WX z?lOy`hhLPHm>fYZ!|Rj8$vBO%ED{bY@RsFw2aDmmL*#>^BUrL9U%(T@U|_zB2$4w; z;+nHcC^#}zgjf2`ie($o)&Z{w96Pow|9$J$-?!~KD5B1R*L4X2I3TQ3AmxRCPa7N( z2))0-aqvJsfSUZOs$@sz0U9w#DLhTr{sNaphi% zT6I?R(QFwWPsXT>WeN%7z*O1rVMIiv-t!5GU_?|5AdJBil6o{TRDv+opOvajyt4;| z+Cl$d|C)Ae-|jzl?l`b}-vN%j2TqDU{oOMxA{b~PV8DPK!VKODesO@0f3Uy1n}@rd zjg6&k&v!0s1B(XUO-qQzF0LoJ?XDOgeEw+=_Y9m<;ZT;x9W0SInDz95un1pisT3M3 zq&gZQ0J8{J%zAboYWhX=M&fyQu0(CPrupfOy2#l>9D8?e-MV|n&QrH<+*J4+${7IT^=aeeJ{vmG0BrHDY84*l@qFxMA-p9dx5N{ zN2OIvsPW_Rxbj{JEO^p2t>A!S3@5V5g5Zz_GQDt$%KG9sRoK)vo|k(4`Hj-mgZuXE zIk0cb`Yr4yFP^*q#4kGfKm?@JT)ctJ9te>^ppPFwkq{V{rvnfpZ5%8eN0zE#>sdfb zVNI6A>2mI%c@)+Sd#p8HY7!5cyT2ScySk~)z zX3Dn#OTP1l)N6YSbsYKhfxUZnZr%9j{tMju&kDZ_2K?87;2>Xjdsje<08>3E)Xf)c z8UhVXy`P4-vtH_w> z@L*=(K0g2@fi(>d4GQ!Oj12SzzIz~?NW0lvS%v~vYpDztVY7~PBz%@fOX}Nxtq4^+ z0GDw86y&~0k<izA{KfQQmgt@qBJ;0pz3o1T#4EB5u>G!jz zP8{XjcZmD!*$Zbx-vdl25`cm1Fawb286Z7?Z3^%U4@1~ZL4Gby&d&DM0U+1(H#X}; zLtcn2+`8Kr2Xx|AY01XU$2!E=p^^ z2}}>NdLel4>W$MU&)+)Cb%Ja2PLWSB(Gd}$kr9C*%%Hsy;b4k`LPG-pF#`CkAjnVn zI6FGp*?wlg74D@GsAO$j7-=rfbAO^C_rb$6HZkfmoo^%Ha5pXAvxe=+#VbdsXYQXr zeR9L$Ex=~o!f}gWY~_?vTkWkYeEa;33s+BEmy~>P`wY9##~7eELKGJc`vr^XoU5__GUec1|N zvu@gd>;_Fn)hRf=cBn7GQR?EkJ?C%T<0tZ8ymM7R-uf#rJfou^eH<3#7ql+~sHH)n zVSva23lt1?zz06g-3^E@767>Xi_JRI*HBqh?rUo8ototz{Kn5V`GwD;N6NBCZ|yn7 zdEms}3tZ=JU*l7eeeUWJR?^Www@~7sLAWMGzkBIER`5RevD->E!I6;>k-!@ZjR*ys z6Nn0BhU^Lo2?7u<>=*$7VS&COA-?V&UM>#q?a;|?i=vK5fQV&HGMcN(K$<)#sC;&) z?Q6b6(B}yEBD1g$Z!BKC*0*?R=4NW|>lB?+(+7GtteG5370j8FGKN_GyWF>Nr00Gy zp<%$-gP1HdA}TZpmKHN;7vl2xhaiD7LU{7@3v&1H@OE^rV=jEdB~&1?N6hh#1`rf0 z&PYqm9cW`t&9rwFHOFRUqz1&~MP&!arWCdI_fH~hR?gY>&vJa1xzBQ6<>i&oFme8p z6d4oqH9R2D2f&L6+!HL^9#~1CAwE7qAqf5#V6DJl1kRj?t3xp~)Mc^BrL0X0L(OpK z43Mz7xrwQh+Qllfj0IV`J#LF)% zI4p=6vMe|>Y$sq$LxH;qs|dQ-2f7+apP(>qpZph@b*{G-Zj2NZWoH(amZs*xos6dM zWY&XBAhQm4j(5~%Mh2QliOXod^$v(^XvxT1%NfA`1*SKczZa6jItJ%K&eG6^i*?2X>mz5z%t{~@-snyKcg%yHQ`G@q;GT# zfY%a3!hJl0-2KDD64R2>vl5e20BHCX#x4FU{CiMvG=L|eX~1X$XTgu^nYEC`wJ=x#Dq974h3UC@nb~l$IVCeIDR0QcY2?+#3=pC_v1sftl=rz>PLQ4-MgcgdTC^npi4J!(HexE1c=*&6ip6|WC z`z?Rm*K3AAz&v~HwfEX+eu0 z6}Tv@d8%9@Q7M!F=hjK2!o$2RkHf}n(F#`A^4s^N7e{yt1CccMazZ2@zwy12{0z|T@@vzmE{6#PvpG` z=PNH4)~FEHm=E+;60hSwiO5Ro){ui2(d!s8GC2<&rvKm8h&n0+ECwDZtzKuez?bsuq6$4sAW4%~+*M zDg;%fWfi(I%EBSQFMbm|$;=E2cMU~h>Q`O;pMqpv_`9ZFA`wZ%b=AVU`r68hDp4gI z80Zdq6yZD-Zj};=q;)Xfb@if}N>D+msb7p8OE3f{l^0`GhPzkrD)fle5WvZ-Y#{g~ zxBvT?tka%el}oEZ%Y|k{z)F{A*H#x~XB1bJSJ%T%OT>T(*Vc)KD<{GAD#pT4Trw

RI^pzsG2R!HfqzcHLJLZ$NdyWo#KQL_RCqzfIN2}5 zR0FG?k#QzTaN%DvOu<+9&*ia_51T6s%i)SwR+UlE>GI0j%G^}wr%V8O;1pDX$y!xb zoL|gGx~xD~WKbf|73%WIqDjcs02YcN_Hr(TX3a{=v!>0#& zwF+*Tu%;*}uMz{NSb&8Gbm?*ddY@mCp9cpYHUUu%0QZFj2rS?Z@~JPA)2V{T%=FUU zM|oH+slL`De*d#@tV;4rm}Om0SzbXIz`Z5KU_=W_E5KETza>D2gN_Z(Z;_7w5n>{Q zL|N%n9E@3zQ&a$OeG!(*oPzB1iRsz7>1l<{cmI2ctjnKXsl(jFd@d2@yt)?dDlBR?7^e^*FC!x@4=mhV#MQa*lF{oKS)iPb&&o|LY8lKL?Q~aww*G60 ztU!Q{JZR0&Mi&FVimVIDK0snE1B6{r1$Gf^PCdw^gn^eit9&*Z?+bu!w*Mh5GsL%rw<(i-83O3Ck>lyshJc;HX|=1Ih9w@eEt4^4UDypoKG2;-&=)Ai0M;vvXY_s zJSwcoN1bGLW-5j?0K+-b^MjB78-c86WqHXbPR0Yb3(#?T zHZSE2FFqa^;e@1k9zf2Rei$0Ol+;t{Ipvxw{~pNNe?e534XP?o#3?CBiPRCGq{LK; zOq`BcaQb*UQfj=S>c(?mr9MH7PGK}gfvm$fdz<)$XVR0h<3WB;;H92QJcBPO@rg+% z&!p#8OQqen?_leG^xvS;8r2oRvEI0(>a42~;Ep<8Qu--gVoFwOX<_x?F!}AsOJbskK}t&19kvbnjgD*15Y2`^WBcb8?`%+~L)T=wdCV)FQRS32#((N)A) zWo5!DsY2C!_By(Kl&cy+E+7XlYgG*rMMLG8Q~M8{ie*{Syn>G-rmVkoDTQnC?Yji= z#dv^(tVQC|sgCERrN1zIQ{b(I_RgRVAll4jelk6?G(4+&gmb zDfs|s)(1Bm&e#*gxDOVyPG#j33J`77ie++TOZ$zd)%uUvO&UJ=?cD3l$U@guRHUCu z$T@R76h=cG6_3(Imp?!_}OVsF*1c)QV~)a-=Y? zU@)?7n*=d%yHcd1P!6)qNJB=XAI`l@|a&G>YU`O-Nq zu?gG_b5{Md;-{Gl*KIJ5im_kz0XC1ujU(Q&OXB4fRoB)?qzdE!8bDVZMd+Yuw|jAa zc9mc;KP6vz?a?LH4>LdcXvI5kO#1Zgw~6r|efY)9k3awR`!~OMW5Md3?mvC-DlwiI z_l3*xY(ZVESX?U+Rv=^BeS7rN08<^gi`#I8wfVVA_;nZV50lMy(_Wu6Y2xH5uNoRo z`fTP(R@a|H|ic=6^A3k-5El(4L6s!0>%BC(oSNgPVj*R+=xu zmYu=O(75zMF_ODY8fi&Etx|DyWR#o)L@9219yr_9QY9!%<5d%PM#u#RKX`Y_)alYK6?9YgD0Wt2wS|#Xdg1+$%i#Tv9zoLLAKn5W9^zkEy zqB&k$7OkGWei!|CNtGB^9JV&q3JXgV%D$%(y|&Q-_s?~7D$CPyas+xvYp==FmtXy6 z-3~{0zu+)GzeD+zZT-JKAn%foKv5XJdcUb8GcwxGck{IEI~fNv1+{WbYin~&WnN~z zy6N_FNbBR?_O2#TRas%a@K+rmt%5}_eKLF1c6%nrCp_|S#rcaAzJZ!4fVAGb(GYiN zxBrGk>%!ws^Qqb1+FD;Pp`GLtE*)VRmssxFj}jY|9#EoZMI&)dqd;u?hc^ABn2$H#y{%2 zWNBb(p|Dme5v!Vn$3I(|QeF3(p3y2AP9S<-{Lrbtwrbm9u&d&B?j0l_o}IGBbcf|G zM)3ZFN3&X zt8yV>xTCa2byxo>LVSw$5oyq;(FqKdJws3Ntx_j2Q1%azllqkcfwF(Fzu%yL0JXh( zwVfc}#Duuf-hsOmo8uXuA129?g&(pfIkUo##3fYT7y+X7#)&z*_%-#gAIc6T5UmS^ zV(9>YqNp<+gnk6N1R`q)=L52yBpC1pbYtHMfaEh65R4tpfhCb0h{NR!JhC8}m@~ub0^%hyx!g{ep-nGZT$Y4fUv-q-% zdZ1R9U?AwjCk;F$iM~e()H!dw5PUehqDL=22b|O==e2Fkb*cvU50-V3S9ZO;Vx8^8 z$fJi(ig5L5FZs6ag40eO79fS9{emMft+OP}(hJ~*;xSpe1j8PZ2gyXkkOJSl#MAco zD|re1B=yrc?GV|IS0kkE`$rNc@O%3E1b-3}kH6m8*{%?^rka0TM&9(E{M9-Jdt%J7 z*fQ)B>wsy!?z<}w$Psn(`HLnvu0LJWB)&9?X&o3zFdQP4csdVmhXx|^ps;a+{C*NY z5K733elQY{q!7Q$g41BA`P0Lp)q7`w3zxR?9p7F4XfPVJBs+H>oN)YbCB=w6PriA@ z&!xDcyjtCMuJV1{v@yHBMcyN$IISXlu#hCt1fmDe;Zx6pEufUF#gNgCB%n|jlHE#;g zYVGJ~>rt)v%%-nn4KZyVGw5J)x)E^gxQOy?9oez%xL7QbHT7h@gH!yIqg$Iq7xlUJ#V?_C{ z^@{MdFZ|j(r7S*UYP#q%!gXQ;(IP$F&Sr8r=2x% z`aFN`k(Bg)63^9-kpZVuDn+BRxwG_B!sxXL%eqx{RsH%WQ=?IYiI34aPDzqOStALP zg&GZJ9;PLJc$u%%|AdDRW&Oz-;ITiqw4Lwh{5js>qwq%e@h^R|E%snWhWZKF4U{9< z$*7hq8xhV0Z-78(G5% zMm+wXy7vslpuDMR)SmCWA)7vKS6##u;@xlQ5jp8~V4zda)Ex_MRyN9&ozfo-4W}5r zlGr7aDu%|Msh|8qnCDc7;t@k47*{^Vs^O4`hi|hm{U#6f2n7P|;GgF{_28%Na&`BG zOLw`%4>?`m5R<37cpS>+-+=E5hU;TSidwCZG+p3K88_9Cc=uelQaZ+P9qQL<40;AB zW3I(_eS`N&L%mqa4iXI4-~XUPXTdQPtWC^Im9am>t_<T)eU<6Yg;tDOL_o$n7O2qz6|g3&wX zoMU;pzYdeITDvdx zo;%;M&~Q;_)(6DvOBmerGjbigABs(z6W^|DoZ5WRWBgkv$ssxkHlMBgV9Ml) zhK8@Fv?_{A{(!lr=)IT5j*Gn)ekp#JSkk`3(D2=*t{zG0ofM7r0%revBrmjGs#Lc1 z(GAAqGJRreyH=d1KrMw#?=OPqdQYS3xzu;*yz}_CY6LG46Q*xA+n*u=?V0+74{+k* z7vD;3zBit)f8XE}+@tbRQj54eMND4guw&1m z+A*x_d;KhtLR>9w5zid|nW2H<_ygT_RRta3+eq~iq*HU|QM0tY>%zrrT*Bbc?>h_( z-*?>14o^iDo1W{6V@W6XcdHfkjlGV+ZSup9o^^q>!%wo zzMJtL@#;!P+pvhUkI0Ldbi-s1w?fmXR9?&-KmNn1FTG2IwPBmFV>E~X)%9_+tXbRE z-M)*MQLJ5RF#eN`J2+7Vda7$LbToMIAZ}8WcU;_J@X`m9ClWuZTO^g@LEUpQ>&O)a zE`wFJWxO#l=5FW|th{D6A&0MykzKXidby-V)t~mN(YOgl1}`UoA5wo7@x5DW zRZF8t)nrSU-K<_oO!{u?R)q6;2IGHPXA!ukn;dya_2IQ+;#QDCt~P#VIKc=8 zWI-!nf*KgE(LTh#f7mUpm13j@PMXzuXDKoM3zLlu-&~9zJ=%3RKe1IJX=u6Zg38Vr zz$3?MQAmUmwy_V$f}e0jBdeFed-=QJUh?#KgAYu1Sa2h|DY7dy$bLN`Q`J^CT~3`! zyl)Az>*|gMxkzzOryC8EbE&yR-qJRS#0rhZi+Ja^w(p1u3+yeu0!klIp8?zZBqh5= zC6QmaWoBsbwf$t`J^&YFD9oyv@sk% zi{;?4`{4CK@+uyLxqYZXqi*c_?dZo7h_6wtx~o$mt&%(i+_hf>m)MZ6901%^Lk!{= z2WbSG&4W*zCF*-bKGGP%Fh0VsbmV=Ft{-)A)H^)`Fv8?x4bcz7PY&Xn!HZ-LdgW?k z719x!CMSYU%03$RfpwruWOVCY5wp0sx@C~n* zYQf#M>f*90nJnqsFWRnd!=0HNdsg7Fhhtn<{RM-hD893yqgm5`Y?8smZJ!VZ4rd!w zQVQ%$0abZ-;p9ElHwB*U5Fx)U10!iFqq?b!>1qj=Z%M@T_}R@>I0{n^owc-;{L#qF9( zC2G-8FiOEKbn&phU(ga|0)EttJ$9^H2G9r38$$X1Swjib@F7U7W(dGbNCVyQFgf#a zyArjRs8Pyps6~NJV~tWKmDM62S0k@&7Rvd;0(r|t@(GE6bW&f8vZL$VrJDjBF=Yn> z5l~%=Tn5%VdWRUq6VWYH=fLY2OrY9?CcfA^zatDo=7AbU&=l1sXown9#2}@z3uLL@ zODBhB-RjjgwY0Q$0P`k8!cUHxHL(aaDH0U+)rmxEB?zQtwYj;SU60_w>VV(Xy~jJ= z)!g23r+e-vh8L@e!XQA(+r~OG zOW)Eybl0c=FZLK`MbGjZ~~!+6a4GSvxUX(eWEKJANnMOUh~yH#D9*KZE$t zHgXE_O8$A3qOwE(JAxYC`d9+5`i5X)=*^Ul>SGAh|3VAL`gk-L=TrZ3tm!?-;$%^O zh*v7KLv{joMgK}Nk`lp>XuPO2yZq{%-^lk{1LObzs?K{5;}#_1{%5NzUFv!v_RjRPifTO-5&a$m*p{O%RHbOfo?tszvI(8;sYdkuefcm9Q)C!wDaI z#Y`rq6!*1>3)`UsFkbbo{)g80ztDQ#SU>+s0spM^n2rWR7(ztfc?2}Cq1Tbc9=zOz zq28iuYEX##J5Z8AdnlyE0L(yBr^rl`- zeern!Qz3wnmc$x}Av`)NFdF_)!hc)>B_zNgA`mXrk&7N&P^w#7+rXh!HlV*HbyX5+ zousU$Oi)>XA`FqBs#;Vbtd~cd#HM%2mlU=REue%KAX0q>d2?WcVMFn3xGKWGPUO+JQu{E)Li`c z&8Pg8QCs!L#6|W4&K4;^`-gf+G5Ph-Rh3lJ)z#jt64ln#iOcf^qI#52w{+BYRo6C_ zhzg`-#dQ@8jcQfmhd{m>x}+uf#1z)l*EdL23dt)Hr5Y8ZC>&MRoT@>S;EX;=O_7%u z)~RbY{AijgT{zAlrdKU45k1y3UkBl7@iY(q0|FTK4`EG1HIx2tpBWysU-%SpKZGFo z=SV5JTz9imq0x4CYFb*F8bs21L20$5PF9gyp1m*U@agp9{OwsuaeV)S?uSk^3BM+Y zX-n-=>d!bGEv*o#nj0IX(${4wrBtSr*4Ne7mGk+(VhUhGOh?K>B=X8qr8;WHMvsxW z&xmE0y5tpE{eZqAfn~rSctpZgqm1dl9Q#;f$7aY2&4=%ZwrkFja&o2a{xvL9?cJS9 ziKe+hB(JHeugOf$JDdn->1uwrNcg0no-e<`zfqREld(1Oj{ZL5&2oA_$}d5xG~`D7T|#{>7E z0qx_zHh%EYGj~AW-#QY`4xe&vo*RAiJQ6Xoa5|%sy*^8!t!cIV^#KL@`(;I^b95#h~S&Q zsDRsO>vO{iH&rzB=jK1q8%=CcWSvFx*Xqb8*Sp$Uz`xe2rBxz%izK(Wte~zZGi0~T zoUJ=%&3Ngv^S-TBuBUxMN&T>HqTeDCUm|rIehc1wzIvhy}esfRnvfKs$zwrNn7l)Xxcm9E%)``zQfDy z+#OC3hZCwv+rDe1$@C?Yjb_c5N_;YR!=7}M;>$!RYL<6>tCqn?NwKRcuNT$HWwoj4 z*s;)&1^d)8MZHGtwqa}hZO`%J{Vueq>$52KYd;S|h>za=*8)%>OCJ?D{7C?qP6*I< zmQ<0(53ja0YqhQItqs*x%7&V(T&29~3~lD>Ip3^z_Yji1eWHB!k`lk5Kvn^n;^!aj zUeyya=j#t~73KIh-`T`Rp>V6VG$Bv=U3-hBQB;p@IB{JKb`4d6@Z!59dEHxxr9s?w z;BQMdT`iwNe9_e2Aj*{>=mPt7NQlHRVuyd-ehhwnwDG+8_w|NzIH8+tCQackJm^+8 zwP>2#)$(dtqo|;$vh;-Crs;239Q5(s8{{?6;^7<2DZL-)70lf;)avN%&k7hg8xqLb zI(N}~uwn%Pm zBF63QZ;=+|Q%4t}0WA+Hbc7=RT7W;CX8hHQT7Vd^pGct!yD^MR?zAeJLA=&9z@96L zGjo%oSxY|n$-z@X#`uQ$`xhQ$1_Uq@lRN_ayb6AcU~$}idwvO~`*?fil8&DslqFtX zmn%}@;7Z=tXKI_9+QDDPWL7I{YEX5XSakK8x4f!EP}9BViyysjWluF)+I_aMCaoFt z*FpXRG(z7v(U>!=x1)ca#?L+I(LeoT9fKS_dO3Q!Ne#LDQ9F7N7}|P4U85u~dAGyd zFE$v{BO<(7uY^T}0YBu<4GiE0Fu@>l-{bG<1NH>c^QS$7E}RX{K%2>5%RMO`0}Lq=F0Lajo_zSl~|sYfvxAU^j`=X1W25LXBg45F{yO-$-;nI%VZguyP{Zcm z`xyV=n*#F4A5Or=0KW^#qRmJL{npsfq-odGV_#9666~_@qc3*^rY6QkM~8*_1$l+i zxy+E*D8Puke7GDynA|+*!B?ej?%ueNnC;@?#iWNSGv`h+BBolTH`aaK)PlWqX}emA z7)~z2y^K}Dl4DV2l7h-+;o`S8T<+Xp_+jl8tujxj8-Yk@AA*ztN|^sYA_?>&3A)G* zl0epY-BmU>~NdJ2yDe*AqArpU5LI zG-u{iYHxIOWaRGX$ncO*Z?3C7o#XGvrmM^|rOAD2C)H)?`qH&c&Dq`T>!9_~O{ za%i5u-ZXah?fOp*4L+L1P}d7&bxDcBmgcsW2DzNV+vMe+q#sJ1{#g*I{eV~|lQ$~z z6j*oq{)td18~EQ%9lR(~2l>t&l}M%0)RZBDj&z*;rSsv~i16@;2wkKuVoqdKB&DwK z@UZak;2_YueHd1b{pXmpj#~}6OhMJQhuyDZXn>5P=wwC7HjGSV@UK{Y-j6O@Eb$3U|lcO5~*fMLhnZ zOw`sNatWO>jkc|(yiQPl%6j_-pZ)v7DVf6OV=_fWKxd&L;bEbnkx^j*Y`2}(xOTnt zw0nvTcQ2W+%L#WtQp`&Zi^-0<)N;au$yxa-F~eZBKweo}pL?pjsRL;&QKLpIZ79!8 z2!4+^G?eoiF|S_MAkNkd_v#ZlR7#4PO+8d5n+j75u_ug76}G2gJ*eEDUa~%Na5Q44 z%0~W~E&pTqoyCoDNRc)+w>MRm!{baco$i8bFd$E46cnb{+4zX?NLas-u&*M*130v` z3rx+nyIa=X*-g(n>+8&<)7;$I9t7N}%Zz^m?&Gda*?05TBA3Vj+cSDAdcI zMY$LMRHb~L;3v7^em)wEAjiYQnd9NY+|S!K?G<8OmJCOeviB8gI?r`e*+_Yl zxGW*b?<86GCb6lpQ7KH-_F%DuuQ~LGlKK)7ZsKQ%(TDf-!SBBn;2ilmF1v4&wW=y= zs;kxf<BfyFwm$3_zg>tffJjb!b2DzO%vG z>20lwY(52n)u7c#HBdth>3SZO8dqY=h>y1i|3g~nK}_@c)3ZnymQ*)N&n3-$d)LvJ zpil@91re|SMMmw$%!wEYpB)w&92OkR^$!SUnauiOp~(hwGbfu}u5OOb3=Yf9jY$E^ zDS&i<@XGCTsnOG|-XfM}wTJ|T8KGINJ>BOzv|Z;qT3fRGIWc=bAQ*C4a}DpJo&r0R zg?5jo_$e{^5^ht04&>;6w*ByLm7%}dMMwUOsy9K2Tr_yme1>hJNn+z-awbcWgF zm%^lq%3}V$y|rEEI<*}gXV0B$&WfJ7t3#Fduz7^mMW z`?s?6kRJ_os#;`aQcSvZz+QTi7o6SLqRbjY!S?VGlIb@TN98ag2SsqSu@8xgk|8ZsnFQj|-DZG8?OZV8MI55wvo9vK!AhHxhY5{1FP(M6IG--U-#x(W^o@N#xBTf3D( z-?n!3N-Iycp0Ea#BH(nMpyhEu;bghEg~Yugyi)jqfkTa?9LH}$D|Fp&V$yfFceF?R z5Sn&I)}gA%N41_7`(Hhp5mZ!a2l|jYH|*Ca@sp-!5C;+lwAA;?p22(s0KHT)2cDR^ zsQMMpa$LV|*IA>)F=LPKC~e~cPkJTSWhg96-Lopu;o`q8(nTDf$E z9ax|gGLPor?(A;i?gAaKJvo`u)(2laIiI$S_#t0elYD$HE33H!HODPTEOhyQ;+TD; zphudFOLL!H{A4+NUaqLBmsMQJ_}hDI-$T2DqToGYGKTp32ZaO&hK2-%P{RS1CL$y> zFeE4-D8SX(Zu1IjU)LSrv@cp|Nq5J^%&u-Oj;ye>Q)k%p;P}RCm(N`ge6c%-X7$SW z1B$wYU0;45Q`g$r+}5GiXj?gN?Z}NwRMxymgtffgD6g!PR-UhS`!ps#JbZT;JkiKd z^hiKpXn1H?cqsmd&l4FD6@`XGAnfz9b+X^Q%+A}&-g?c7WeZo?GF@E260(d|U8xYB z75cMP&B;fjU1^`Q+*koW61I)?i60WLI~S;1l&vidP1=s2DXWtcPUPoxK1afmx@k{( z8pV|j%7Ms?t zS-xbhu_Ks9&KCQwlyY2bcXywl1-rOAxo~{`=I7(>zJ{1z+K@P%n6xBO)q-sl70!nE zPnvxw{nY8ii=#InT_UY@WWQQf)g%)9>h$g^Rx$rjP;?Z`K5S)Jct~JyP;gjSNN`vv zdIP2tMw4=#B78kPtQW0ivaQyyShIHZ(uFIxy4X89?W{Vv*3MyT%ng4pju(r|^<{tN z2)69Tai6BCQ>GCHp9G7*VOO*^DP$opO+T2Clz6Ii=oymr?ZQX_5eU(|>ij7~jN-bqgn3k5ElyoZj+_PqU z+Sec}Yp!XPd_K-R#Lp*)8xoAZhvby(A%P(gPs4wreE#sTU>L99;7~5dn`W{EL)2!= znw1MzEL*Y0#LN*W(!+(4$~(}rSWqCkBEZ*!8{)iV4V~k#-DK_Z1q+reU9oQc4r>={3pV`_*Ms5Vd~gyR%)Boa8a0k7o7YC?Yw8_`c|4WXWFWq7Fgue+Ix1l|g&9hsZ8xYL?~$!Y0X zwRfKJVP~FKD0;+&Me_}2`@37aI7c$vd@*w{YeT~#LviLIC>RGd!XiR3e8`B;!h-_> zxK^~|j>g;Fxc;=ATh}dKym0=UZ@!s3ca5ndh-n@=HsP(~KwJI>KAzM3l0NLt$EigM)$se1if)!a@*g zQ1&-0m`isEa5LNP;L)$SONvrd~r>*P3%A7?uI%N6PQnF+@dcu7gg7lxnlVP}jC_sDw`6{pvZ zo8aZf3G|^cnUP-h4DSHS>cZXy1qTNN2lz+m!VO`8brD~Na@??`v2lZocfgTAtMw~a zE?>E9*@8KLU%G0}vh~&&J4{b6uFhwoAEe=M12`}F+j_e=n@^f17j6Y1cEUW*>RMb7 z5d71uFV~+&V@@1NOiqfg7#VF*KNZQ4x_hclt*p#vwt@M@f!6jY7k6d^2UJ*3U#N_l z?12*k0{ysfpGU&~jxim`@(y-0HMV92Cq`~F+puQ&@|8=LFZ|)V6-&QgvC$TN`f@ai12{Za^;?+WHh$2ud?-r~f$L25riW-*Y&T7oRlntW8c- zVZ*QT3rb0bsoA()oq{T!3*F5#%7Q49e_k;W3@9)Re{~r_rn*^^uaQ8kJV^ar) zPi(61s#WVuRxDk)eEH&qOV`f-#@Ni>o$2At@#6aXayb6M!TykI25e}smHEW!l|}2O z7!czuLb3$qJa6Mq7yaEeKRYomG3Ma0#8ao$6et!2c~mJb^;!%Ui^9l|Bdzjtk{XX0 z-@f5&&$Qj);_5;RJHm0Ww{vk1@b!mn;bI-|^9O4@C_Kd9Cm=8~+#cKh8EWcVV(Tyf_@+V1KTEP*`93-o`{NQj%J1?dUw&`@DK@+a797w9FrqdcdmKlq7( zfkglpp&eKst}blw-mNX%JUHIqcr)pqp5E|o8Js{QhL}6o8E)_KHb&Cj7>Ats!al}V{bQ@#f z;y?R--Re^%IKQ8o6nFS|{GpR=6fL#~n@C90Q=(9X0#rtbDpf+lXsjxcYQ4Vh@wr5Z zji3G@&s%*>o%KT2+r(6B7s~)=4l?yf@aTNju^i0JeZ4upJ{~Nu0JeWX$o|;aXtw?K z&0BXlGP&L!?%P(Gn(o}PeBOe23l`2@VZQap?~J$Evpl`I-W;xvFMNpre_t+_3ef7^BIF6m@E@8E8(EvO`x4or3cmjRE{1b2U%o6MiT5W{V=*OpmxH&{Efu!_R- z^6~M5Je1$#%bvk;ayQ-f&P%Z}(~sxOoxUT?e%Z1gW>5dh*4VmCz)R0bO*#^L^vJQ8 zVj&tkND0G36RFCC^`=ht4z?^V3r@V3vy-E} zql*jDT&^@ncTQv!%L(S&X8mf@&6|x^t}xxSZt*;m0Or!!%aEjC*d432aj;>#d2jkbtcQ_(IU*| z{^WXq&34TDEr%W;Nu)EpgJ8{>@MpSaYK|N|peis2_GWn{%2NlZC;B>u#)xXzKM`6n5g>SQx+5HL49@SXywTx67oUbtY`A+p{mzfN%TIZr<>m+H}j2cmr{nrbT3aoEa(fjTwGc!m z@uQaf;KkjUQkZTd?!W@*TI^TAN!qSXeNet(@UuFxjpfY~8#!8*jCB zGGAq~!+F=r1q)Z3tX_aDjpf|gOZ?6RxOzD5>90GSaV0)b&ire^eeSiwB#ygT)E!D&V0$d#j95@+UVuB{QCurjA({Cn?{ds{#7He zSE*clDg#^{-8_8!yl44Xt$p?7!x{VOUwrb_tc={4ysSg(!uZ>hN(xicGk74Y9*;ee zaO_AVvZ64bXuiIbRHvazK;S{4s?}fsBa}Kz`^RsoLeqaD9hCe`I?TMMXEnm2qqBb? z%=g(kdL#eu>Ehg8>Nfj8sfne-j!oOa+u3emZeg=&vjfd)qop&$e9d|*C#%(~*6*@g zzwoDJre-!f=Kr*KS8B2!954>kGBh~W?ZCre$JpEVs}B3xVey;gv1Oj&+bO9$+Zl_D zw}?_s<>&9;*0$d*wJ<+5E1L&w$BEdOlgHy?YRM4@r>`^}CQ&s9Z5i}KG-@kk^le<- z@~4@Gtt;Lz^s2=d{@8e=ggW0`TzuGM<+yEFn0>vOOi#=5S|kqSAsek6z%#dDW#k2uMpdW7TYPV;hhJbK)X z<({p*_vl4nN&a&Y!dvZBk7K_1Qvz<7hrI&{9h>m{b`i;>my9>2l0h^4sD9@$|>k7GA z$xeQ8KCV4Gqf456EbeI3(Zg|jiz%^Cm1@L;DL|1O5A}`I8mELnt~eZ@FdN7Hf;0F7|8ILZsCj zY-~-J8gH;NU$ktigRRNBO-tvkFn96uWqEjeW2c_&jT<)*<{;J0rMWu#=k`7w_{#fj zVopZkZ!HBLHv1oHiW=+o^2mMBm8Ds@w;Jk7192tbK-_^nB_lA7qjjnfN`#FPoOBv{ zgW9defWrYbs(y@elTqx3qGn22n&$!`ro7ewsLoG>;lj9|74Vb-Je-R<)K!eRrp>;a zc7XN)de3@GE3;jUt*bUW+ih5}#oEev<(e(qHZI#mcQReJY>CNEH?AKPR`uY1ZncE`L3ual28^_FPesZUWcer6hEYg&P|J=*qmlbE`P?yrBXPh~HfDwHx zCZbYLk45n+!6UR7em#hS+S(>dk+q_}h=FJvc&F$>ht=wY0edX${7TcCD-R9=Hi)L-S zWW}n@yJ+6XV^YE(0EL3^Rp@e+>tM#b&+Q|kG#J@*h-iiS{VH3W%7uydoutq}3A67@qO=*W=wOr-0i z@yJC*UO~oc!f<&!*B#D~OCZPD?Q%!M?RN6GxufNVjo_)7o9%EkGu^gj#cBw*z=UDH zajA2lx8s&&%U7FOy1HYt)XQsxJpqzH97r>Tg<tlV zKpg$HBjU_a0spEX67mS2$#a8*rPK8);}7OX%o{f|Ab?E^SKLfz(=!JG+#PIbPBb@H zXUolI+by=3S=xGYLup$$hfakZ2xmE&Z(hD~&6*9~2t7GI)DVOJ&xJs!9`nNPBP9_l z_Lq(*x-VzVxS6lBt5FvE;Ckmx@`?JqT13_}Qu9D7#?|tvxb2;HJT5Nkz`odH*FlpS z5~A8;)YBV4-J;+D^%hkO3pM>k8l33Ej-}?gIL1iLU8y}9UVM5!@sX2{XWESi8E!0k zeDBRjcOM4Q*w_}c*=Ys19oRZMTpevaJe`@2W?Q$Jt~WEYaoN2eiDjlM$D5<`B-!s` zk@eIo%7exB@nLyuZavBk^ZL|qrg_S**id}<%f$!ejqaa&?>`7Unh!i-AvBblnv$7% z;%Kb*z5{zt4FV>sMJ|R4D4`wfr4rhE)LWQF)EoaG4n#NXc_z+voYMJ4e0)z~@k(OK zx+7=F^U-!5ek|{!F)VLCo#z^)n;3Lw+g)}pPQb|mfVabB%N7%`NL@Vr_a6-OaG<-> zT>TgfwuiSDi%F%-Vca-u4-X7MA6K_y@~eB75ubk*hh;?f>QSov7RQAz`JCWqJ5}vwS$d{@z?JCbgFbg)5~qoNR4e zTsdJeCy(W3oybj2Pm0|gikdK2OIE}dt0UwICmIT5Juo)mdL!ZH<>T#4hjn0vhy6&r zwIz1e1?nn-;Riz_y4$w~b;AkK`PuxU!cq_~C|p9unNz3Zxcm1-P`6XUqZ=!a9Z8_h zKw#}bJrW}RKi-FOsCUN(9)22=tRIq*&m_A>zIRtyvVV6)#!Q3v?47xOPOKmYDvjsw z=c8kj9wc)G-Q9WTM(fQ^j<(Luo*~?D&j2rXx|1uCH@5qG)eXK*=UV9w9-b&cU}6#h z>W(oNTI6j<_uPHP3Z><-I3Gaj3`xMUbQ5mf!xa}^DY}feDOOc>W_ngyUV1Y4tATs> z9&FPSWf96#C9-<4Fmpy-gBJ^D|CvxY^=kwVd~EPtBRAYv*Y5YtFSmGwSQQ@V?B15- z?#1;B45ETM6!LnoSPt7#E+hq8Y}sjT?`-F6>uhUpXX}D81P9;F{M@edk^7&9Ia2i% zROVUd`MQUfw`K^ivO`V`sq+eOBPgRb_@&ZyX-xj5Q8;5!H9O*515C*_{MRl2&e-I*+R zOg`9c4^O&V@#Fhh4C}WEqpd}caFqts1TRbXF{#VgTfk4r%qal1Dl;=TGbfXG^4O{9 z{V|cpf2TaTQHgNP%s-JxUo-p9B%+dRNNYTk=_>ig<;o0JY-Q%>#4C%F?%&yG?-%H& z;8kGD06KV9NnEzB7q;38rjr}8KzME@l>3Rc$#kU8e?fm>W*o(nN4?Hm}kxZBH zCw@Pe2bz~Wwsm%OqtjjJbnu$pn69>GrCV*R<8N<^B2!T<#zwNu!_&=&W`jx?hG)c{ zxrT)C2^{-Hl=ERv$f>-XQ~(=tAWU+4eqLsJ3Sg{$k#T#Qh5x6LXdp@d3wp89^%R5{ zpH@V@j&0u*TaLdQjm`4&LsrrU&WtzH-uIeh_h|={U*x-(bcn*Bp$Nsn4V4zc+g>}2 zv--BW6&<0r17H%|=~2C@G~^IHxUMrNjGG>F4&~~g{oYE5157q8Gb0l)uQANZ6^@VcSioI&Go-5hE1TcJVw0VU?IcX z|Fn!|=k00n6+wLOD}$|mOn%yXEEbF&+`EiR^7%Qq(VCZ#l$mrU@kr#!!>PE_1JebA zNMHY|mj$_lF$?hQZT#5te27u?SUUU(Y#_2mB%Ho6qjrU~e%PI1u_#*+{tjVe?C%zR z=T0Q{To94LNHLkTD1S#6Iq6#ZvxOsy^=PiHG*@SPCl?yS-X*g2{;x_7RcXL-_jGk( zFumO@_S_gswsl_f{y4)K;R;-(gm44~;1lxK(1`TxbY3QgRu+g-6dwB&QY8rqhxQ#i zR9mHAXOLta#64h`FwZSCmLL7w5a*9`F+=(?xiN7NqL0hM$@D+uu^YKw9sUJVQsiPp zd|>I?`8bY-*@F3k;XPDiIqDQnJ9Urc^`43RD&BKk5Y47762!f_)~!WzzP6_UO{@PS&6Kf*^iM zAtNk3*$zyq+LOs((wu^hU-)(8;O-|*mP~h=n;VLAku|3#zdH-{p)T8E&PO|;YMdec zo$bu@VA{~m^e4T6I{0AKjb4?i_kS zcA+lP!`+>UdL=l~VUdVtO)m@yQZLXKWeL z?btJb?hBIL5QZO!O=|d=oKBAXhKuD6GEai)%R}-zBP|Ua0myUaC@`AHogR(Z2Lo3H z?;kakln4Dx3cNv;!2VM)1P}vBl4rW;BW)gP4$S?0kGOEdWa7)^EDqbg?7B6!#2Fq8 zH#*HOh-I^7pC`?o#=v4iXW(RytAn#EWMVLx?so2H@A|p2*p30+4E zF_MtvMwK@;znz?5tuUS4nJC?1SQU=sS-E?#?BX6au&iBo{)B6D%oED;4%jbRZDQl( z?GW=tQ%5Oxt808_L0T&AvIiG4Ju5jSIVmCjSX^Rq^6B_f2{9C2b`bl^h?{wR5A`zq zf7M-ydsIcX?~t$?M0OM&J2(!a4*F#DISh^)%pi&bC~HVaNZ1h+WKDoeefOgCB@Pal`q!Z5O{-l(lr(g0zK*kIf9| z>*j)+9Hir7Nn~aL%s3rdHyhh{4gzTDdCgz0OkchtZSkQN`4xip**7b&yJXh*dj>r4 zz=WqKKRb2QruA!{SV95bLzV8W#{6&3PET8mDOkFk zK*#4S1``=bJzRo>r6pMVSs5S3e6t}}>6?F0o=62?^s80!YtIbq(y{BPK_mY-YW&Pm z%jYcJ!TN(LFR_eQD3y7ZmwBvd6hl@;o~2mpdkJ{io0+Xm?Xp}WNVGVkkBc=%R`ndP zqWe5bJ@morSo~ccU6ivh5~pY9EP44*6q2|wt#af1 ztjt9VUQS;OQWnlfD0@ZDDk=?F?~9jzbHThI=e79{^f7fFG1Eb(|JT@l9Z`F-Xa9cP zIzKXP`iR9gMHG2a;#f{#Wxobc2A_o35<_FeD2k!#+9lOCzwde^dC2DaBSj-SnUWuz zu{L^qUV6@g<<0NBn6YGz`G)6ZI4>8OUr5i%%2=~$I_^rOAO3#b{AEirbE@>W-pKgt z@Dx+(GaH@x^GEkY@#CcA4xPIXy1U=dX=_GM3g8B4k>^=S6lIKs>X$h+6yQZcf!E2y z|932wNbdco-tF?cmS>ZD=Nvp~c_MC_(rfkZO|$1^&cx;6zb(posZ!7VduGmzk3XC@ zH#>9Pjf_%V$8C@eFNgfE9l;$2bP*Mg z_Y2LQm46zQY`SC2)Yt9S#ZNvn0K3c)@#2V zn4Xn3cjdQNmM&cV+A^W8@YUJldvwD4r>$~H`B@L#c~6f{os*MN29F&+tk=-#TP1*l z2t9cs5EQE@8n$LXr|fG~!-s@f{ZJyX*W@wd zXDwJ=tuwg6IB%=IZ(iD(H`ZSKI@hzUAn&C=4ZO=_O1|?CQx}&g-ZjrZI;cy>l%$lD z9(_mLJFM@dwR}MK1!PGVI*Gu0hCs#wePp2wz%h~xNDPW%z1~VB2HZlIz536CA?v#5 zo_uMOH}H1e?1xRbXgslN&q2$BE1xyn%v;X**D}^E7L`IK-M9`&I52e^HECKlRVC!F zd~oF5cXvri9eUTmfqgo6eRPB71FU5rAc#YGPSD^R7lH7h3cL~kmWw2bGUKIOlpEf& zctQ|Pp@P#dpT51jYV+)=lh>Hda**Hj7*VZx|cV<$dz|Jd%MdIMgz zYmd&u`++%2Di1svFy)d`}e;NxxQu^*{%0I zBOjmi+#44EvG2~7=T9Bd-_(1^h_Qd3aPPPw_f6g+D@tiliwPZAPE3`7X9N6iUXlUe ztHh;LUQu`kO5EcL<1PY>K~A)H8;!n~KXc-ksZWjRGy2i-_x0^D^luwHya*r{VC5=M ze!Tb}*t1nxvjOd9~RzctmNbou@RWwILj^rP5? zpFcaj|3jv-Oe^$OdBYaBQv2!IubZ!3iR+`TU;5(cy5}Dr)^A|%z9U9HK4n>+3@rwT z6^8Y&oW%12$BK~eyE#SWL`4$>NkGO6##&*q|4^TR)5M!kk}BC(PrkKh4}bvoMndj@ za^(1>>oI-&HU0be0sy0x8UYA%-RRw`(8JUHyQ&^t&9=ZiKd*$QWefuK-`3mi+iAW)}>d>*T zzDEf|R6QB@^Ves-Z2aJ}!}}C#VfMtwC;l~KTd|v1Ti{6&Bv@Y@#V|647_#K|4^Xkm zF)ZsxmXc4?%I^W7;?&V^KWx}7 zh!$MpLZa-eX|KLfXoav;mil0Fi&{{DGQgA~VH*)g98wikHi=Snh`D8UlP*byXQo-QW&DM_MRY76{-d z;fA3S=Q>M11?b*hrmqNyYgYAXDuX4YDhdZnM*5-+ZMN61r$be{BK!6nK)2NdBCl$9 zyy}s1!KMN-tSkiFyHc#*HU)S=LO!&!39hW{DWd!yubQbR4N1b+f$W{_5Zx{}0a zn|O){DUwu;{IsT619H#w7~F>`(X$Pah;H0&BE=@Av>X9^Uu9)=_1;=Q5!TcI2N#I* zl_FPGSzhTAWFd&Wcz;j>WO5M5P-UfBz+Z~^g(eYm4hPDhDk_5J6P>oWw;Id04Q=Nognn%tE9Rp0vzXX{T1f~94ir@NeYvU)WkEATR_e~ zM+%0R6NO~G>mz_51OCTZgKzRs=*FjQ5}YLy^V^&@QL z6MX><7^Qw6zz7u}6$7NJ9O_R~pzZ@@D*SsA0I;~;JOj&_p?C#y1$9NcspE)bBH5NC9kv9n^@IA`uk6NRpyt0@}Ba>&Z=#2&%c0CQali@q3bj?iivd`AxXKL!z%% zR=exhzO2T$16RB<7%zRS9P6;6RPlvQ>rGQd|QG6rx2v zJ|Shv%?(T|tHfW1&=kHm#E|sV)*eg9=$U*X_%7kjJYkb`k}ToKim_;pFkllEm>T^w znXn4@R7=bKg50Gu^wz|pxGGzLIR6Jf5djX5G-H<^dmDd{{(Ni}{0QqSVyO-2(< z+jE875U?M^$(8hOz&k)xPb65n`W`C?3RnOZ9Kw~VI~4TVN;n*#f@Q!K3==f&K)Fv+ ze7-GBU1hx&dUy{n3=># z?Z}SeL0w`(JA|8>iQk}gVgSc*iy<&*v~153+SLMJ0Y&``w#X|Wp2zj0`qP&W3RoqI zBErDtU=1k#fMB)qh`9hM9f0BlBO7J{cz{tvd2uumF(*hh$0>=$@e#;#JkO-kK%`^9 zjMwXQzu64XSwfq19RmsBL#PuB;U2$kcx?@`Az)GRqzN3MNFY|u2~-Qd$r6#xo3eMa zZCiuHCsM9}Ss@`_N#=@lcAhX*uTQ-2memQWc-bez0mDgJFvwb5K~YrU4hWQ22ZMee zc;-b`5LtlNVQYh#0&B#FO^9N-IGaSf@1QBClV#nW5=U8MtOB$lRRI6Sn5Y3_0A?WX z2A^@FkBwM6qSQ$dkU<#f2)}0Z1k}Q9Duc8neo!)ZZG0d!msFcz1Koq&^N|}7Q~ha7 zkRBg*B~)UeS%S?6w-U@7tvo%a!HH9Tds6e^6lhRZY6yyUXD_c@?m;#$X#l^}lBU!Ppa*;f<=r21ydHL2qJTA`gh4@YZl+ z)}jP)Lu#WtB}zPPiGAo@y?^ZOlI?a5xzYjy5iyKs1uh#Yt_&_mP#+c$!@xxXx*_j0 zyp*u1-5ld`VaAb_OH+={PA~0t$VV;#bJln<)+!NbVzZz~hi-@wL^sd?p@nc<)RWJh zsFQ%Ga2^7M-9JKdx$w)IEr`4JHV#PsE7(M@DNV?)Z_rV8mNYObCSGfB@36VxMBrGL zn*o}mU%^?{=Yyif{s?jRI;?J3${g+SxM-J~rd%+!@aOS*Z62@N(a}Xa)OvzB+eSVn z8A;L5h(ynZ$pE*avEchKlCw~G06QJ_fYv1u#@!`2|8Hw{I}?T#R%?`{C7ok~L43w| z-D&+@{r55b`ghe^cQ`1lPZuN?6T#DxjC>?P!nVL+&vRRyFs+;=*0`;g)lNCA9yge9 z!GZ5_J3Y>1GxOG0T5F%sGMH~-Gnr}$3*>4DUPeL>1VzJCe-$H7)D#&~V;ab4g0b5g z-7f!x0|4cqwihA*=mXnNdln`kj2*vn#Fe+B$l;~Q7EOB@ie?1W$MLG5$Q;cvHW#MA zR$OAUnys|QUgCk*%f-M2$2dwXRC3K{zs1_I&=g}jN=;D!OW<`Vev%k3utGA&;92el z>8fpl5Jj7yb`lHW79VKc+LCP2=ZN-94xc-R9o*;#SAR?=3}((E2QAWsn>C64PwR*E ziQw(pH`N833M_UfeNQH{cV)4r79BY9zg9Co1+TG;N0OPfq zOG@j`Tq4M`h6rNf>!AVzL|%+9$R{W?(%y(Jl+L!%o{$lcVYEmNNB<9n=UZT=BX0>G z#tMBCxM4TG-p6mSY};;il@t~g+2XDdUdm}Um!M=te%_XnB6Eq&?r@cutuCvBa=E+? zM^)p+U*bUBNYHbIT(m=v$zi}U-69g=NCffP&7%9^29$BU$x|yUMl00TzG;#}Mu^72 z9FS90Jv0e)Pq-e19QW%F#lAZdD%!YyD~cHGEH+z8oOWyR&fLv;1w}gww-h;?_MM>B z?nYAGcDu`exalfNvhO6C0ygEB#27gj#v#Rk;5vya-uFlKQ^!hO=GS*@wiN6v+PSl+ z$Xt|HSZH&Y^LM%(R$IY#>-NHed?v8x!z+5rbsU_D`zNB0z7hS`KlYYb-YCd3uiw5c zztCddR$Oeg>~L(`QMk3xW-qO-I`-Xn&GWo9{A!HsgRJ(qq5;_}yn8yCnrHw3 diff --git a/docs/reference/src/index.xml b/docs/reference/src/index.xml deleted file mode 100644 index e00c770019..0000000000 --- a/docs/reference/src/index.xml +++ /dev/null @@ -1,4015 +0,0 @@ - - - - - Acegi Security System for Spring - - Reference Documentation - - 0.7 - - - - Ben - - Alex - - - - - - - - Preface - - This document provides a reference guide to the Acegi Security - System for Spring, which is a series of classes that deliver - authentication and authorization services within the Spring - Framework. - - I would like to acknowledge this reference was prepared using the - DocBook configuration included with the Spring Framework. The Spring team - in turn acknowledge Chris Bauer (Hibernate) for his assistance with their - DocBook. - - - - Security - - - Before You Begin - - For your security, each official release JAR of Acegi Security has - been signed by the project leader. This does not in any way alter the - liability disclaimer contained in the License, but it does ensure you - are using a properly reviewed, official build of Acegi Security. Please - refer to the readme.txt file in the root of the - release distribution for instructions on how to validate the JARs are - correctly signed, and which certificate has been used to sign - them. - - - - Introduction - - The Acegi Security System for Spring provides authentication and - authorization capabilities for Spring-powered projects, with full - integration with popular web containers. The security architecture was - designed from the ground up using "The Spring Way" of development, which - includes using bean contexts, interceptors and interface-driven - programming. As a consequence, the Acegi Security System for Spring is - useful out-of-the-box for those seeking to secure their Spring-based - applications, and can be easily adapted to complex customized - requirements. - - Security involves two distinct operations, authentication and - authorization. The former relates to resolving whether or not a caller - is who they claim to be. Authorization on the other hand relates to - determining whether or not an authenticated caller is permitted to - perform a given operation. - - Throughout the Acegi Security System for Spring, the user, system - or agent that needs to be authenticated is referred to as a "principal". - The security architecture does not have a notion of roles or groups, - which you may be familiar with from other security - implementations. - - - Current Status - - The Acegi Security System for Spring is widely used by members - of the Spring Community. The APIs are considered stable and only minor - changes are expected. Having said that, like many other projects we - need to strike a balance between backward compatibility and - improvement. Effective version 0.6.1, Acegi Security uses the Apache - Portable Runtime Project versioning guidelines, available from - http://apr.apache.org/versioning.html. - - Some improvements are currently intended prior to the 1.0.0 - release. These are: - - - - Replacing the Ant build with a Maven build. When this - happens the lib directory will no longer be - distributed in ZIP releases or hosted in CVS. - - - - "Remember me" functionality. Some discussion on this can be - found at - http://sourceforge.net/mailarchive/forum.php?thread_id=5177499&forum_id=40659. - - - - A sample web application which demonstrates the access - control list package. - - - - Implementation of an - ObjectDefinitionSource that retrieves its - details from a database. - - - - Deprecation of Acegi Security's various EH-CACHE-based cache - implementations. Instead Acegi Security will provide new cache - implementations which use Spring Framework's new (currently in - CVS) EhCacheManagerFactoryBean factory. The - deprecated classes may be removed from the 1.0.0 release. - - - - Whilst this list is subject to change and not in any particular - order, none of the above improvements are likely to result in changes - to the API. The improvements are also relatively minor to implement. - Users of Acegi Security System for Spring should therefore be - comfortable depending on the current version of the project in their - applications. - - - - - High Level Design - - - Key Components - - The Acegi Security System for Spring essentially comprises seven - key functional parts: - - - - An Authentication object which holds the - principal, credentials and the authorities granted to the - principal. The object can also store additional information - associated with an authentication request, such as the source - TCP/IP address. - - - - A ContextHolder which holds the - Authentication object in a - ThreadLocal-bound object. - - - - An AuthenticationManager to authenticate - the Authentication object presented via the - ContextHolder. - - - - An AccessDecisionManager to authorize a - given operation. - - - - A RunAsManager to optionally replace the - Authentication object whilst a given operation - is being executed. - - - - A "secure object" interceptor, which coordinates the - authentication, authorization, run-as replacement and execution of - a given operation. - - - - An acess control list (ACL) management package, which can be - used to obtain ACLs for domain object instances. - - - - Secure objects refer to any type of object that can have - security applied to it. A secure object must provide some form of - callback, so that the security interceptor can transparently do its - work as required, and callback the object when it is time for it to - proceed with the requested operation. If secure objects cannot provide - a native callback approach, a wrapper needs to be written so this - becomes possible. - - Each secure object has its own package under - net.sf.acegisecurity.intercept. Every other package - in the security system is secure object independent, in that it can - support any type of secure object presented. - - Only developers contemplating an entirely new way of - intercepting and authorizing requests would need to use secure objects - directly. For example, it would be possible to build a new secure - object to secure calls to a messaging system that does not use - MethodInvocations. Most Spring applications will - simply use the three currently supported secure object types - (MethodInvocation, JoinPoint and - FilterInterceptor) with complete - transparency. - - Each of the seven key parts is discussed in detail throughout - this document. - - - - Supported Secure Objects - - The Acegi Security System for Spring currently supports three - secure objects. - - The first handles an AOP Alliance - MethodInvocation. This is the secure object type - used to protect Spring beans. Developers will generally use this - secure object type to secure their business objects. To make a - standard Spring-hosted bean available as a - MethodInvocation, the bean is simply published - through a ProxyFactoryBean or - BeanNameAutoProxyCreator or - DefaultAdvisorAutoProxyCreator. Most Spring - developers would already be familiar with these due to their use in - transactions and other areas of Spring. - - The second type is an AspectJ JoinPoint. - AspectJ has a particular use in securing domain object instances, as - these are most often managed outside the Spring bean container. By - using AspectJ, standard constructs such as new - Person(); can be used and full security will be applied to - them by Acegi Security. The - AspectJSecurityInterceptor is still managed by - Spring, which creates the aspect singleton and wires it with the - appropriate authentication managers, access decision managers and so - on. - - The third type is a FilterInvocation. This is - an object included with the Acegi Security System for Spring. It is - created by an included filter and simply wraps the HTTP - ServletRequest, ServletResponse - and FilterChain. The - FilterInvocation enables HTTP resources to be - secured. Developers do not usually need to understand the mechanics of - how this works, because they just add the filters to their - web.xml and let the security system do its - work. - - - - Configuration Attributes - - Every secure object can represent an infinite number of - individual requests. For example, a - MethodInvocation can represent the invocation of - any method with any arguments, whilst a - FilterInvocation can represent any HTTP URL. - - The Acegi Security System for Spring needs to record the - configuration that applies to each of these possible requests. The - security configuration of a request to - BankManager.getBalance(int accountNumber) needs to - be very different from the security configuration of a request to - BankManager.approveLoan(int applicationNumber). - Similarly, the security configuration of a request to - http://some.bank.com/index.htm needs to be very - different from the security configuration of - http://some.bank.com/manage/timesheet.jsp. - - To store the various security configurations associated with - different requests, a configuration attribute is used. At an - implementation level a configuration attribute is represented by the - ConfigAttribute interface. One concrete - implementation of ConfigAttribute is provided, - SecurityConfig, which simply stores a configuration - attribute as a String. - - The collection of ConfigAttributes associated - with a particular request is held in a - ConfigAttributeDefinition. This concrete class is - simply a holder of ConfigAttributes and does - nothing special. - - When a request is received by the security interceptor, it needs - to determine which configuration attributes apply. In other words, it - needs to find the ConfigAttributeDefinition which - applies to the request. This decision is handled by the - ObjectDefinitionSource interface. The main method - provided by this interface is public - ConfigAttributeDefinition getAttributes(Object object), with - the Object being the secure object. Recall the - secure object contains details of the request, so the - ObjectDefinitionSource implementation will be able - to extract the details it requires to lookup the relevant - ConfigAttributeDefinition. - - - - - Request Contexts - - - Contexts - - Many applications require a way of sharing objects between - classes, but without resorting to passing them in method signatures. - This is commonly achieved by using a ThreadLocal. - The Acegi Security System for Spring uses - ThreadLocal functionality and introduces the - concept of "request contexts". - - By placing an object into a request context, that object becomes - available to any other object on the current thread of execution. The - request context is not passed around as a method parameter, but is - held in a ThreadLocal. The Acegi Security System - for Spring uses the request context to pass around the authentication - request and response. - - A request context is a concrete implementation of the - Context interface, which exposes a single - method: - - public void validate() throws ContextInvalidException; - - This validate() method is called to confirm - the Context is properly setup. An implementation - will typically use this method to check that the objects it holds are - properly setup. - - The ContextHolder class makes the - Context available to the current thread of - execution using a ThreadLocal. A - ContextInterceptor is also provided, which is - intended to be chained into the bean context using - ProxyFactoryBean. The - ContextInterceptor simply calls - Context.validate(), which guarantees to business - methods that a valid Context is available from the - ContextHolder. - - - - Secure Contexts - - The Acegi Security System for Spring requires the - ContextHolder to contain a request context that - implements the SecureContext interface. An - implementation is provided named SecureContextImpl. - The SecureContext simply extends the - Context discussed above and adds a holder and - validation for an Authentication object. - - - - Custom Contexts - - Developers can create their own request context classes to store - application-specific objects. Such request context classes will need - to implement the Context interface. If the Acegi - Security System for Spring is to be used, developers must ensure any - custom request contexts implement the SecureContext - interface. - - - - - Security Interception - - - All Secure Objects - - As described in the High Level Design section, each secure - object has its own security interceptor which is responsible for - handling each request. Handling involves a number of - operations: - - - - Store the configuration attributes that are associated with - each secure request. - - - - Extract the ConfigAttributeDefinition - that applies to the request from the relevant - ObjectDefinitionSource. - - - - Obtain the Authentication object from the - SecureContext, which is held in the - ContextHolder. - - - - Pass the Authentication object to the - AuthenticationManager, update the - ContextHolder with the response. - - - - Pass the Authentication object, the - ConfigAttributeDefinition, and the secure - object to the AccessDecisionManager. - - - - Pass the Authentication object, the - ConfigAttributeDefinition, and the secure - object to the RunAsManager. - - - - If the RunAsManager returns a new - Authentication object, update the - ContextHolder with it. - - - - Proceed with the request execution of the secure - object. - - - - If the RunAsManager earlier returned a - new Authentication object, update the - ContextHolder with the - Authentication object that was previously - returned by the AuthenticationManager. - - - - Return any result received from the secure object - execution. - - - - Whilst this may seem quite involved, don't worry. Developers - interact with the security process by simply implementing basic - interfaces (such as AccessDecisionManager), which - are fully documented below. - - The AbstractSecurityInterceptor handles the - majority of the flow listed above. Each secure object has its own - security interceptor which subclasses - AbstractSecurityInterceptor. Each of these secure - object-specific security interceptors are discussed below. - - - - AOP Alliance (MethodInvocation) Security Interceptor - - To secure MethodInvocations, developers - simply add a properly configured - MethodSecurityInterceptor into the application - context. Next the beans requiring security are chained into the - interceptor. This chaining is accomplished using Spring’s - ProxyFactoryBean or - BeanNameAutoProxyCreator, as commonly used by many - other parts of Spring (refer to the sample application for examples). - Alternatively, Acegi Security provides a - MethodDefinitionSourceAdvisor which may be used - with Spring's DefaultAdvisorAutoProxyCreator to - automatically chain the security interceptor in front of any beans - defined against the MethodSecurityInterceptor. The - MethodSecurityInterceptor itself is configured as - follows: - - <bean id="bankManagerSecurity" class="net.sf.acegisecurity.intercept.method.aopalliance.MethodSecurityInterceptor"> - <property name="validateConfigAttributes"><value>true</value></property> - <property name="authenticationManager"><ref bean="authenticationManager"/></property> - <property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property> - <property name="runAsManager"><ref bean="runAsManager"/></property> - <property name="objectDefinitionSource"> - <value> - net.sf.acegisecurity.context.BankManager.delete*=ROLE_SUPERVISOR,RUN_AS_SERVER - net.sf.acegisecurity.context.BankManager.getBalance=ROLE_TELLER,ROLE_SUPERVISOR,BANKSECURITY_CUSTOMER,RUN_AS_SERVER - </value> - </property> -</bean> - - As shown above, the MethodSecurityInterceptor - is configured with a reference to an - AuthenticationManager, - AccessDecisionManager and - RunAsManager, which are each discussed in separate - sections below. The MethodSecurityInterceptor is - also configured with configuration attributes that apply to different - method signatures. A full discussion of configuration attributes is - provided in the High Level Design section of this document. - - The MethodSecurityInterceptor can be - configured with configuration attributes in three ways. The first is - via a property editor and the application context, which is shown - above. The second is via defining the configuration attributes in your - source code using Jakarta Commons Attributes. The third is via writing - your own ObjectDefinitionSource, although this is - beyond the scope of this document. Irrespective of the approach used, - the ObjectDefinitionSource is responsible for - returning a ConfigAttributeDefinition object that - contains all of the configuration attributes associated with a single - secure method. - - It should be noted that the - MethodSecurityInterceptor.setObjectDefinitionSource() - method actually expects an instance of - MethodDefinitionSource. This is a marker interface - which subclasses ObjectDefinitionSource. It simply - denotes the ObjectDefinitionSource understands - MethodInvocations. In the interests of simplicity - we'll continue to refer to the - MethodDefinitionSource as an - ObjectDefinitionSource, as the distinction is of - little relevance to most users of the - MethodSecurityInterceptor. - - If using the application context property editor approach (as - shown above), commas are used to delimit the different configuration - attributes that apply to a given method pattern. Each configuration - attribute is assigned into its own SecurityConfig - object. The SecurityConfig object is discussed in - the High Level Design section. - - If using the Jakarta Commons Attributes approach, your bean - context will be configured differently: - - <bean id="attributes" class="org.springframework.metadata.commons.CommonsAttributes"/> -<bean id="objectDefinitionSource" class="net.sf.acegisecurity.intercept.method.MethodDefinitionAttributes"> - <property name="attributes"><ref local="attributes"/></property> -</bean> - -<bean id="bankManagerSecurity" class="net.sf.acegisecurity.intercept.method.MethodSecurityInterceptor"> - <property name="validateConfigAttributes"><value>false</value></property> - <property name="authenticationManager"><ref bean="authenticationManager"/></property> - <property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property> - <property name="runAsManager"><ref bean="runAsManager"/></property> - <property name="objectDefinitionSource"><ref bean="objectDefinitionSource"/></property> -</bean> - - In addition, your source code will contain Jakarta Commons - Attributes tags that refer to a concrete implementation of - ConfigAttribute. The following example uses the - SecurityConfig implementation to represent the - configuration attributes, and results in the same security - configuration as provided by the property editor approach - above: - - public interface BankManager { - - /** - * @@SecurityConfig("ROLE_SUPERVISOR") - * @@SecurityConfig("RUN_AS_SERVER") - */ - public void deleteSomething(int id); - - /** - * @@SecurityConfig("ROLE_SUPERVISOR") - * @@SecurityConfig("RUN_AS_SERVER") - */ - public void deleteAnother(int id); - - /** - * @@SecurityConfig("ROLE_TELLER") - * @@SecurityConfig("ROLE_SUPERVISOR") - * @@SecurityConfig("BANKSECURITY_CUSTOMER") - * @@SecurityConfig("RUN_AS_SERVER") - */ - public float getBalance(int id); -} - - You might have noticed the - validateConfigAttributes property in the above - MethodSecurityInterceptor examples. When set to - true (the default), at startup time the - MethodSecurityInterceptor will evaluate if the - provided configuration attributes are valid. It does this by checking - each configuration attribute can be processed by either the - AccessDecisionManager or the - RunAsManager. If neither of these can process a - given configuration attribute, an exception is thrown. If using the - Jakarta Commons Attributes method of configuration, you should set - validateConfigAttributes to - false. - - - - AspectJ (JoinPoint) Security Interceptor - - The AspectJ security interceptor is very similar to the AOP - Alliance security interceptor discussed in the previous section. - Indeed we will only discuss the differences in this section. - - The AspectJ interceptor is named - AspectJSecurityInterceptor. Unlike the AOP Alliance - security interceptor, which relies on the Spring application context - to weave in the security interceptor via proxying, the - AspectJSecurityInterceptor is weaved in via the - AspectJ compiler. It would not be uncommon to use both types of - security interceptors in the same application, with - AspectJSecurityInterceptor being used for domain - object instance security and the AOP Alliance - MethodSecurityInterceptor being used for services - layer security. - - Let's first consider how the - AspectJSecurityInterceptor is configured in the - Spring application context: - - <bean id="bankManagerSecurity" class="net.sf.acegisecurity.intercept.method.aspectj.AspectJSecurityInterceptor"> - <property name="validateConfigAttributes"><value>true</value></property> - <property name="authenticationManager"><ref bean="authenticationManager"/></property> - <property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property> - <property name="runAsManager"><ref bean="runAsManager"/></property> - <property name="objectDefinitionSource"> - <value> - net.sf.acegisecurity.context.BankManager.delete*=ROLE_SUPERVISOR,RUN_AS_SERVER - net.sf.acegisecurity.context.BankManager.getBalance=ROLE_TELLER,ROLE_SUPERVISOR,BANKSECURITY_CUSTOMER,RUN_AS_SERVER - </value> - </property> -</bean> - - As you can see, aside from the class name, the - AspectJSecurityInterceptor is exactly the same as - the AOP Alliance security interceptor. Indeed the two interceptors can - share the same objectDefinitionSource, as the - ObjectDefinitionSource works with - java.lang.reflect.Methods rather than an AOP - library-specific class. Of course, your access decisions have access - to the relevant AOP library-specific invocation (ie - MethodInvocation or JoinPoint) - and as such can consider a range of addition criteria when making - access decisions (such as method arguments). - - Next you'll need to define an AspectJ aspect. - For example: - - package net.sf.acegisecurity.samples.aspectj; - -import net.sf.acegisecurity.intercept.method.aspectj.AspectJSecurityInterceptor; -import net.sf.acegisecurity.intercept.method.aspectj.AspectJCallback; -import org.springframework.beans.factory.InitializingBean; - -public aspect DomainObjectInstanceSecurityAspect implements InitializingBean { - - private AspectJSecurityInterceptor securityInterceptor; - - pointcut domainObjectInstanceExecution(): target(PersistableEntity) - && execution(public * *(..)) && !within(DomainObjectInstanceSecurityAspect); - - Object around(): domainObjectInstanceExecution() { - if (this.securityInterceptor != null) { - AspectJCallback callback = new AspectJCallback() { - public Object proceedWithObject() { - return proceed(); - } - }; - return this.securityInterceptor.invoke(thisJoinPoint, callback); - } else { - return proceed(); - } - } - - public AspectJSecurityInterceptor getSecurityInterceptor() { - return securityInterceptor; - } - - public void setSecurityInterceptor(AspectJSecurityInterceptor securityInterceptor) { - this.securityInterceptor = securityInterceptor; - } - - public void afterPropertiesSet() throws Exception { - if (this.securityInterceptor == null) - throw new IllegalArgumentException("securityInterceptor required"); - } -} - - In the above example, the security interceptor will be applied - to every instance of PersistableEntity, which is an - abstract class not shown (you can use any other class or - pointcut expression you like). For those curious, - AspectJCallback is needed because the - proceed(); statement has special meaning only - within an around() body. The - AspectJSecurityInterceptor calls this anonymous - AspectJCallback class when it wants the target - object to continue. - - You will need to configure Spring to load the aspect and wire it - with the AspectJSecurityInterceptor. A bean - declaration which achieves this is shown below: - - <bean id="domainObjectInstanceSecurityAspect" - class="net.sf.acegisecurity.samples.aspectj.DomainObjectInstanceSecurityAspect" - factory-method="aspectOf"> - <property name="securityInterceptor"><ref bean="aspectJSecurityInterceptor"/></property> -</bean> - - That's it! Now you can create your beans from anywhere within - your application, using whatever means you think fit (eg new - Person();) and they will have the security interceptor - applied. - - - - FilterInvocation Security Interceptor - - To secure FilterInvocations, developers need - to add a filter to their web.xml that delegates to - the SecurityEnforcementFilter. A typical - configuration example is provided below: <filter> - <filter-name>Acegi HTTP Request Security Filter</filter-name> - <filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class> - <init-param> - <param-name>targetClass</param-name> - <param-value>net.sf.acegisecurity.intercept.web.SecurityEnforcementFilter</param-value> - </init-param> -</filter> - -<filter-mapping> - <filter-name>Acegi HTTP Request Security Filter</filter-name> - <url-pattern>/*</url-pattern> -</filter-mapping> - - Notice that the filter is actually a - FilterToBeanProxy. Most of the filters used by the - Acegi Security System for Spring use this class. Refer to the Filters - section to learn more about this bean. - - In the application context you will need to configure three - beans: - - <bean id="securityEnforcementFilter" class="net.sf.acegisecurity.intercept.web.SecurityEnforcementFilter"> - <property name="filterSecurityInterceptor"><ref bean="filterInvocationInterceptor"/></property> - <property name="authenticationEntryPoint"><ref bean="authenticationEntryPoint"/></property> -</bean> - -<bean id="authenticationEntryPoint" class="net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilterEntryPoint"> - <property name="loginFormUrl"><value>/acegilogin.jsp</value></property> - <property name="forceHttps"><value>false</value></property> -</bean> - -<bean id="filterInvocationInterceptor" class="net.sf.acegisecurity.intercept.web.FilterSecurityInterceptor"> - <property name="authenticationManager"><ref bean="authenticationManager"/></property> - <property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property> - <property name="runAsManager"><ref bean="runAsManager"/></property> - <property name="objectDefinitionSource"> - <value> - CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON - \A/secure/super/.*\Z=ROLE_WE_DONT_HAVE - \A/secure/.*\Z=ROLE_SUPERVISOR,ROLE_TELLER - </value> - </property> -</bean> - - The AuthenticationEntryPoint will be called - if the user requests a secure HTTP resource but they are not - authenticated. The class handles presenting the appropriate response - to the user so that authentication can begin. Three concrete - implementations are provided with the Acegi Security System for - Spring: AuthenticationProcessingFilterEntryPoint - for commencing a form-based authentication, - BasicProcessingFilterEntryPoint for commencing a - Http Basic authentication process, and - CasProcessingFilterEntryPoint for commencing a Yale - Central Authentication Service (CAS) login. The - AuthenticationProcessingFilterEntryPoint and - CasProcessingFilterEntryPoint have optional - properties related to forcing the use of HTTPS, so please refer to the - JavaDocs if you require this. - - The PortMapper provides information on which - HTTPS ports correspond to which HTTP ports. This is used by the - AuthenticationProcessingFilterEntryPoint and - several other beans. The default implementation, - PortMapperImpl, knows the common HTTP ports 80 and - 8080 map to HTTPS ports 443 and 8443 respectively. You can customise - this mapping if desired. - - The SecurityEnforcementFilter primarily - provides session management support and initiates authentication when - required. It delegates actual FilterInvocation - security decisions to the configured - FilterSecurityInterceptor. - - Like any other security interceptor, the - FilterSecurityInterceptor requires a reference to - an AuthenticationManager, - AccessDecisionManager and - RunAsManager, which are each discussed in separate - sections below. The FilterSecurityInterceptor is - also configured with configuration attributes that apply to different - HTTP URL requests. A full discussion of configuration attributes is - provided in the High Level Design section of this document. - - The FilterSecurityInterceptor can be - configured with configuration attributes in two ways. The first is via - a property editor and the application context, which is shown above. - The second is via writing your own - ObjectDefinitionSource, although this is beyond the - scope of this document. Irrespective of the approach used, the - ObjectDefinitionSource is responsible for returning - a ConfigAttributeDefinition object that contains - all of the configuration attributes associated with a single secure - HTTP URL. - - It should be noted that the - FilterSecurityInterceptor.setObjectDefinitionSource() - method actually expects an instance of - FilterInvocationDefinitionSource. This is a marker - interface which subclasses ObjectDefinitionSource. - It simply denotes the ObjectDefinitionSource - understands FilterInvocations. In the interests of - simplicity we'll continue to refer to the - FilterInvocationDefinitionSource as an - ObjectDefinitionSource, as the distinction is of - little relevance to most users of the - FilterSecurityInterceptor. - - If using the application context property editor approach (as - shown above), commas are used to delimit the different configuration - attributes that apply to each HTTP URL. Each configuration attribute - is assigned into its own SecurityConfig object. The - SecurityConfig object is discussed in the High - Level Design section. The ObjectDefinitionSource - created by the property editor, - FilterInvocationDefinitionSource, matches - configuration attributes against FilterInvocations - based on expression evaluation of the request URL. Two standard - expression syntaxes are supported. The default is to treat all - expressions as regular expressions. Alternatively, the presence of a - PATTERN_TYPE_APACHE_ANT directive will cause all - expressions to be treated as Apache Ant paths. It is not possible to - mix expression syntaxes within the same definition. For example, the - earlier configuration could be generated using Apache Ant paths as - follows: - - <bean id="filterInvocationInterceptor" class="net.sf.acegisecurity.intercept.web.FilterSecurityInterceptor"> - <property name="authenticationManager"><ref bean="authenticationManager"/></property> - <property name="accessDecisionManager"><ref bean="accessDecisionManager"/></property> - <property name="runAsManager"><ref bean="runAsManager"/></property> - <property name="objectDefinitionSource"> - <value> - CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON - PATTERN_TYPE_APACHE_ANT - /secure/super/**=ROLE_WE_DONT_HAVE - /secure/**=ROLE_SUPERVISOR,ROLE_TELLER - </value> - </property> -</bean> - - Irrespective of the type of expression syntax used, expressions - are always evaluated in the order they are defined. Thus it is - important that more specific expressions are defined higher in the - list than less specific expressions. This is reflected in our example - above, where the more specific /secure/super/ - pattern appears higher than the less specific - /secure/ pattern. If they were reversed, the - /secure/ pattern would always match and the - /secure/super/ pattern would never be - evaluated. - - The special keyword - CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON causes - the FilterInvocationDefinitionSource to - automatically convert a request URL to lowercase before comparison - against the expressions. Whilst by default the case of the request URL - is not converted, it is generally recommended to use - CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON and - write each expression assuming lowercase. - - As with other security interceptors, the - validateConfigAttributes property is observed. When - set to true (the default), at startup time the - FilterSecurityInterceptor will evaluate if the - provided configuration attributes are valid. It does this by checking - each configuration attribute can be processed by either the - AccessDecisionManager or the - RunAsManager. If neither of these can process a - given configuration attribute, an exception is thrown. - - - - - Authentication - - - Authentication Requests - - Authentication requires a way for client code to present its - security identification to the Acegi Security System for Spring. This - is the role of the Authentication interface. The - Authentication interface holds three important - objects: the principal (the identity of the caller), the credentials - (the proof of the identity of the caller, such as a password), and the - authorities that have been granted to the principal. The principal and - its credentials are populated by the client code, whilst the granted - authorities are populated by the - AuthenticationManager. The Acegi Security System - for Spring includes several concrete Authentication - implementations: - - - - UsernamePasswordAuthenticationToken - allows a username and password to be presented as the principal - and credentials respectively. It is also what is created by the - HTTP Session Authentication system. - - - - TestingAuthenticationToken facilitates - unit testing by automatically being considered an authenticated - object by its associated - AuthenticationProvider. - - - - RunAsUserToken is used by the default - run-as authentication replacement implementation. This is - discussed further in the Run-As Authentication Replacement - section. - - - - CasAuthenticationToken is used to - represent a successful Yale Central Authentication Service (CAS) - authentication. This is discussed further in the CAS - section. - - - - PrincipalAcegiUserToken and - JettyAcegiUserToken implement - AuthByAdapter (a subclass of - Authentication) and are used whenever - authentication is completed by Acegi Security System for Spring - container adapters. This is discussed further in the Container - Adapters section. - - - - The authorities granted to a principal are represented by the - GrantedAuthority interface. The - GrantedAuthority interface is discussed at length - in the Authorization section. - - - - Authentication Manager - - As discussed in the Security Interception section, the - AbstractSecurityInterceptor extracts the - Authentication object from the - SecureContext in the - ContextHolder. This is then passed to an - AuthenticationManager. The - AuthenticationManager interface is very - simple: - - public Authentication authenticate(Authentication authentication) throws AuthenticationException; - - Implementations of AuthenticationManager are - required to throw an AuthenticationException should - authentication fail, or return a fully populated - Authentication object. In particular, the returned - Authentication object should contain an array of - GrantedAuthority objects. The - SecurityInterceptor places the populated - Authentication object back in the - SecureContext in the - ContextHolder, overwriting the original - Authentication object. - - The AuthenticationException has a number of - subclasses. The most important are - BadCredentialsException (an incorrect principal or - credentials), DisabledException and - LockedException. The latter two exceptions indicate - the principal was found, but the credentials were not checked and - authentication is denied. An - AuthenticationServiceException is also provided, - which indicates the authentication system could not process the - request (eg a database was unavailable). - - - - Provider-Based Authentication - - Whilst the basic Authentication and - AuthenticationManager interfaces enable users to - develop their own authentication systems, users should consider using - the provider-based authentication packages provided by the Acegi - Security System for Spring. The key class, - ProviderManager, is configured via the bean context - with a list of AuthenticationProviders: - - <bean id="authenticationManager" class="net.sf.acegisecurity.providers.ProviderManager"> - <property name="providers"> - <list> - <ref bean="daoAuthenticationProvider"/> - <ref bean="someOtherAuthenticationProvider"/> - </list> - </property> -</bean> - - ProviderManager calls a series of registered - AuthenticationProvider implementations, until one - is found that indicates it is able to authenticate a given - Authentication class. When the first compatible - AuthenticationProvider is located, it is passed the - authentication request. The AuthenticationProvider - will then either throw an AuthenticationException - or return a fully populated Authentication - object. - - Note the ProviderManager may throw a - ProviderNotFoundException (a subclass of - AuthenticationException) if it none of the - registered AuthenticationProviders can validate the - Authentication object. - - Several AuthenticationProvider - implementations are provided with the Acegi Security System for - Spring: - - - - TestingAuthenticationProvider is able - to authenticate a TestingAuthenticationToken. - The limit of its authentication is simply to treat whatever is - contained in the TestingAuthenticationToken - as valid. This makes it ideal for use during unit testing, as - you can create an Authentication object with - precisely the GrantedAuthority objects - required for calling a given method. You definitely would not - register this AuthenticationProvider on a - production system. - - - - DaoAuthenticationProvider is able to - authenticate a - UsernamePasswordAuthenticationToken by - accessing an authentication respository via a data access - object. This is discussed further below, as it is the main way - authentication is initially handled. - - - - RunAsImplAuthenticationToken is able to - authenticate a RunAsUserToken. This is - discussed further in the Run-As Authentication Replacement - section. You would not register this - AuthenticationProvider if you were not using - run-as replacement. - - - - AuthByAdapterProvider is able to - authenticate any AuthByAdapter (a subclass of - Authentication used with container adapters). - This is discussed further in the Container Adapters section. You - would not register this - AuthenticationProvider if you were not using - container adapters. - - - - CasAuthenticationProvider is able to - authenticate Yale Central Authentication Service (CAS) tickets. - This is discussed further in the CAS Single Sign On - section. - - - - JaasAuthenticationProvider is able to - delegate authentication requests to a JAAS - LoginModule. This is discussed further - below. - - - - - - Data Access Object Authentication Provider - - The Acegi Security System for Spring includes a - production-quality AuthenticationProvider - implementation called DaoAuthenticationProvider. - This authentication provider is able to authenticate a - UsernamePasswordAuthenticationToken by obtaining - authentication details from a data access object configured at bean - creation time: - - <bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider"> - <property name="authenticationDao"><ref bean="inMemoryDaoImpl"/></property> - <property name="saltSource"><ref bean="saltSource"/></property> - <property name="passwordEncoder"><ref bean="passwordEncoder"/></property> -</bean> - - The PasswordEncoder and - SaltSource are optional. A - PasswordEncoder provides encoding and decoding of - passwords obtained from the authentication repository. A - SaltSource enables the passwords to be populated - with a "salt", which enhances the security of the passwords in the - authentication repository. PasswordEncoder - implementations are provided with the Acegi Security System for Spring - covering MD5, SHA and cleartext encodings. Two - SaltSource implementations are also provided: - SystemWideSaltSource which encodes all passwords - with the same salt, and ReflectionSaltSource, which - inspects a given property of the returned - UserDetails object to obtain the salt. Please refer - to the JavaDocs for further details on these optional features. - - In addition to the properties above, the - DaoAuthenticationProvider supports optional caching - of UserDetails objects. The - UserCache interface enables the - DaoAuthenticationProvider to place a - UserDetails object into the cache, and retrieve it - from the cache upon subsequent authentication attempts for the same - username. By default the DaoAuthenticationProvider - uses the NullUserCache, which performs no caching. - A usable caching implementation is also provided, - EhCacheBasedUserCache, which is configured as - follows: - - <bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider"> - <property name="authenticationDao"><ref bean="authenticationDao"/></property> - <property name="userCache"><ref bean="userCache"/></property> -</bean> - -<bean id="userCache" class="net.sf.acegisecurity.providers.dao.cache.EhCacheBasedUserCache"> - <property name="minutesToIdle"><value>5</value></property> -</bean> - - For a class to be able to provide the - DaoAuthenticationProvider with access to an - authentication repository, it must implement the - AuthenticationDao interface: - - public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException, DataAccessException; - - The UserDetails is an interface that provides - getters that guarantee non-null provision of basic authentication - information such as the username, password, granted authorities and - whether the user is enabled or disabled. A concrete implementation, - User, is also provided. Acegi Security users will - need to decide when writing their AuthenticationDao - what type of UserDetails to return. In most cases - User will be used directly or subclassed, although - special circumstances (such as object relational mappers) may require - users to write their own UserDetails implementation - from scratch. - - Given AuthenticationDao is so simple to - implement, it should be easy for users to retrieve authentication - information using a persistence strategy of their choice. - - A design decision was made not to support account locking in the - DaoAuthenticationProvider, as doing so would have - increased the complexity of the AuthenticationDao - interface. For instance, a method would be required to increase the - count of unsuccessful authentication attempts. Such functionality - could be easily provided by leveraging the application event - publishing features discussed below. - - DaoAuthenticationProvider returns an - Authentication object which in turn has its - principal property set. The principal will be - either a String (which is essentially the username) - or a UserDetails object (which was looked up from - the AuthenticationDao). By default the - UserDetails is returned, as this enables - applications to add extra properties potentially of use in - applications, such as the user's full name, email address etc. If - using container adapters, or if your applications were written to - operate with Strings (as was the case for releases - prior to Acegi Security 0.6), you should set the - DaoAuthenticationProvider.forcePrincipalAsString - property to true in your application - context. - - - - Event Publishing - - The DaoAuthenticationProvider automatically - obtains the ApplicationContext it is running in at - startup time. This allows the provider to publish events through the - standard Spring event framework. Three types of event messages are - published: - - - - AuthenticationSuccessEvent is published - when an authentication request is successful. - - - - AuthenticationFailureDisabledEvent is - published when an authentication request is unsuccessful because - the returned UserDetails is disabled. This is - normally the case when an account is locked. - - - - AuthenticationFailureUsernameNotFoundEvent - is published when an authentication request is unsuccessful - because the AuthenticationDao could not locate - the UserDetails. - - - - AuthenticationFailurePasswordEvent is - published when an authentication request is unsuccessful because - the presented password did not match that in the - UserDetails. - - - - Each event contains two objects: the - Authentication object that represented the - authentication request, and the UserDetails object - that was found in response to the authentication request (clearly the - latter will be a dummy object in the case of - AuthenticationFailureUsernameNotFoundEvent). The - Authentication interface provides a - getDetails() method which often includes - information that event consumers may find useful (eg the TCP/IP - address that the authentication request originated from). - - As per standard Spring event handling, you can receive these - events by adding a bean to the application context which implements - the ApplicationListener interface. Included with - Acegi Security is a LoggerListener class which - receives these events and publishes their details to Commons Logging. - Refer to the JavaDocs for LoggerListener for - details on the logging priorities used for different message - types. - - This event publishing system enables you to implement account - locking and record authentication event history. This might be of - interest to application users, who can be advised of the times and - source IP address of all unsuccessful password attempts (and account - lockouts) since their last successful login. Such capabilities are - simple to implement and greatly improve the security of your - application. - - - - In-Memory Authentication - - Whilst it is easy to use the - DaoAuthenticationProvider and create a custom - AuthenticationDao implementation that extracts - information from a persistence engine of choice, many applications do - not require such complexity. One alternative is to configure an - authentication repository in the application context itself using the - InMemoryDaoImpl: - - <bean id="inMemoryDaoImpl" class="net.sf.acegisecurity.providers.dao.memory.InMemoryDaoImpl"> - <property name="userMap"> - <value> - marissa=koala,ROLE_TELLER,ROLE_SUPERVISOR - dianne=emu,ROLE_TELLER - scott=wombat,ROLE_TELLER - peter=opal,disabled,ROLE_TELLER - </value> - </property> -</bean> - - The userMap property contains each of the - usernames, passwords, a list of granted authorities and an optional - enabled/disabled keyword. Commas delimit each token. The username must - appear to the left of the equals sign, and the password must be the - first token to the right of the equals sign. The - enabled and disabled keywords - (case insensitive) may appear in the second or any subsequent token. - Any remaining tokens are treated as granted authorities, which are - created as GrantedAuthorityImpl objects (refer to - the Authorization section for further discussion on granted - authorities). Note that if a user has no password and/or no granted - authorities, the user will not be created in the in-memory - authentication repository. - - - - JDBC Authentication - - The Acegi Security System for Spring also includes an - authentication provider that can obtain authentication information - from a JDBC data source. The typical configuration for the - JdbcDaoImpl is shown below: - - <bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource"> - <property name="driverClassName"><value>org.hsqldb.jdbcDriver</value></property> - <property name="url"><value>jdbc:hsqldb:hsql://localhost:9001</value></property> - <property name="username"><value>sa</value></property> - <property name="password"><value></value></property> -</bean> - -<bean id="jdbcDaoImpl" class="net.sf.acegisecurity.providers.dao.jdbc.JdbcDaoImpl"> - <property name="dataSource"><ref bean="dataSource"/></property> -</bean> - - You can use different relational database management systems by - modifying the DriverManagerDataSource shown above. - Irrespective of the database used, a standard schema must be used as - indicated in dbinit.txt. - - If you default schema is unsuitable for your needs, - JdbcDaoImpl provides two properties that allow - customisation of the SQL statements. You may also subclass the - JdbcDaoImpl if further customisation is necessary. - Please refer to the JavaDocs for details. - - The Acegi Security System for Spring ships with a Hypersonic SQL - instance that has the required authentication information and sample - data already populated. To use this server, simply execute the - server.bat or server.sh script - included in the distribution. This will load a new database server - instance that will service requests made to the URL indicated in the - bean context configuration shown above. - - - - JAAS Authentication - - Acegi Security provides a package able to delegate - authentication requests to the Java Authentication and Authorization - Service (JAAS). This package is discussed in detail below. - - Central to JAAS operation are login configuration files. To - learn more about JAAS login configuration files, consult the JAAS - reference documentation available from Sun Microsystems. We expect you - to have a basic understanding of JAAS and its login configuration file - syntax in order to understand this section. - - - JaasAuthenticationProvider - - The JaasAuthenticationProvider attempts to - authenticate a user’s principal and credentials through JAAS. - - Let’s assume we have a JAAS login configuration file, - /WEB-INF/login.conf, with the following - contents: - - JAASTest { - sample.SampleLoginModule required; -}; - - Like all Acegi Security beans, the - JaasAuthenticationProvider is configured via the - application context. The following definitions would correspond to - the above JAAS login configuration file: - - <bean id="jaasAuthenticationProvider" class="net.sf.acegisecurity.providers.jaas.JaasAuthenticationProvider"> - <property name="loginConfig"> - <value>/WEB-INF/login.conf</value> - </property> - <property name="loginContextName"> - <value>JAASTest</value> - </property> - <property name="callbackHandlers"> - <list> - <bean class="net.sf.acegisecurity.providers.jaas.JaasNameCallbackHandler"/> - <bean class="net.sf.acegisecurity.providers.jaas.JaasPasswordCallbackHandler"/> - </list> - </property> - <property name="authorityGranters"> - <list> - <bean class="net.sf.acegisecurity.providers.jaas.TestAuthorityGranter"/> - </list> - </property> -</bean> - - The CallbackHandlers and - AuthorityGranters are discussed below. - - - - Callbacks - - Most JAAS LoginModules require a callback - of some sort. These callbacks are usually used to obtain the - username and password from the user. In an Acegi Security - deployment, Acegi Security is responsible for this user interaction - (typically via a reference to a - ContextHolder-managed - Authentication object). The JAAS package for - Acegi Security provides two default callback handlers, - JaasNameCallbackHandler and - JaasPasswordCallbackHandler. Each of these - callback handlers implement - JaasAuthenticationCallbackHandler. In most cases - these callback handlers can simply be used without understanding the - internal mechanics. For those needing full control over the callback - behavior, internally JaasAutheticationProvider - wraps these JaasAuthenticationCallbackHandlers - with an InternalCallbackHandler. The - InternalCallbackHandler is the class that - actually implements JAAS’ normal CallbackHandler - interface. Any time that the JAAS LoginModule is - used, it is passed a list of application context configured - InternalCallbackHandlers. If the - LoginModule requests a callback against the - InternalCallbackHandlers, the callback is in-turn - passed to the JaasAuthenticationCallbackHandlers - being wrapped. - - - - AuthorityGranters - - JAAS works with principals. Even “roles” are represented as - principals in JAAS. Acegi Security, on the other hand, works with - Authentication objects. Each - Authentication object contains a single - principal, and multiple GrantedAuthority[]s. To - facilitate mapping between these different concepts, the Acegi - Security JAAS package includes an - AuthorityGranter interface. An - AuthorityGranter is responsible for inspecting a - JAAS principal and returning a String. The - JaasAuthenticationProvider then creates a - JaasGrantedAuthority (which implements Acegi - Security’s GrantedAuthority interface) containing - both the AuthorityGranter-returned - String and the JAAS principal that the - AuthorityGranter was passed. The - JaasAuthenticationProvider obtains the JAAS - principals by firstly successfully authenticating the user’s - credentials using the JAAS LoginModule, and then - accessing the LoginContext it returns. A call to - LoginContext.getSubject().getPrincipals() is - made, with each resulting principal passed to each - AuthorityGranter defined against the - JaasAuthenticationProvider.setAuthorityGranters(List) - property. Acegi Security does not include any production - AuthorityGranters given every JAAS principal has - an implementation-specific meaning. However, there is a - TestAuthorityGranter in the unit tests that - demonstrates a simple AuthorityGranter - implementation. - - - - - Authentication Recommendations - - With the heavy use of interfaces throughout the authentication - system (Authentication, - AuthenticationManager, - AuthenticationProvider and - AuthenticationDao) it might be confusing to a new - user to know which part of the authentication system to customize. In - general, the following is recommended: - - - - Use the - UsernamePasswordAuthenticationToken - implementation where possible. - - - - If you simply need to implement a new authentication - repository (eg to obtain user details from your application’s - existing database), use the - DaoAuthenticationProvider along with the - AuthenticationDao. It is the fastest and safest - way to integrate an external database. - - - - If you're using Container Adapters or a - RunAsManager that replaces the - Authentication object, ensure you have - registered the AuthByAdapterProvider and - RunAsManagerImplProvider respectively with your - ProviderManager. - - - - Never enable the - TestingAuthenticationProvider on a production - system. Doing so will allow any client to simply present a - TestingAuthenticationToken and obtain whatever - access they request. - - - - Adding a new AuthenticationProvider is - sufficient to support most custom authentication requirements. - Only unusual requirements would require the - ProviderManager to be replaced with a different - AuthenticationManager. - - - - - - - Authorization - - - Granted Authorities - - As briefly mentioned in the Authentication section, all - Authentication implementations are required to - store an array of GrantedAuthority objects. These - represent the authorities that have been granted to the principal. The - GrantedAuthority objects are inserted into the - Authentication object by the - AuthenticationManager and are later read by - AccessDecisionManagers when making authorization - decisions. - - GrantedAuthority is an interface with only - one method: - - public String getAuthority(); - - This method allows AccessDecisionManagers to - obtain a precise String representation of the - GrantedAuthority. By returning a representation as - a String, a GrantedAuthority can - be easily "read" by most AccessDecisionManagers. If - a GrantedAuthority cannot be precisely represented - as a String, the - GrantedAuthority is considered "complex" and - getAuthority() must return - null. - - An example of a "complex" GrantedAuthority - would be an implementation that stores a list of operations and - authority thresholds that apply to different customer account numbers. - Representing this complex GrantedAuthority as a - String would be quite complex, and as a result the - getAuthority() method should return - null. This will indicate to any - AccessDecisionManager that it will need to - specifically support the GrantedAuthority - implementation in order to understand its contents. - - The Acegi Security System for Spring includes one concrete - GrantedAuthority implementation, - GrantedAuthorityImpl. This allows any - user-specified String to be converted into a - GrantedAuthority. All - AuthenticationProviders included with the security - architecture use GrantedAuthorityImpl to populate - the Authentication object. - - - - Access Decision Managers - - The AccessDecisionManager is called by the - AbstractSecurityInterceptor and is responsible for - making final access control decisions. The - AccessDecisionManager interface contains three - methods: - - public void decide(Authentication authentication, Object object, ConfigAttributeDefinition config) throws AccessDeniedException; -public boolean supports(ConfigAttribute attribute); -public boolean supports(Class clazz); - - As can be seen from the first method, the - AccessDecisionManager is passed via method - parameters all information that is likely to be of value in assessing - an authorization decision. In particular, passing the secure - Object enables those arguments contained in the - actual secure object invocation to be inspected. For example, let's - assume the secure object was a MethodInvocation. It - would be easy to query the MethodInvocation for any - Customer argument, and then implement some sort of - security logic in the AccessDecisionManager to - ensure the principal is permitted to operate on that customer. - Implementations are expected to throw an - AccessDeniedException if access is denied. - - The supports(ConfigAttribute) method is - called by the AbstractSecurityInterceptor at - startup time to determine if the - AccessDecisionManager can process the passed - ConfigAttribute. The - supports(Class) method is called by a security - interceptor implementation to ensure the configured - AccessDecisionManager supports the type of secure - object that the security interceptor will present. - - - - Voting Decision Manager - - Whilst users can implement their own - AccessDecisionManager to control all aspects of - authorization, the Acegi Security System for Spring includes several - AccessDecisionManager implementations that are - based on voting. Using this approach, a series of - AccessDecisionVoter implementations are polled on - an authorization decision. The - AccessDecisionManager then decides whether or not - to throw an AccessDeniedException based on its - assessment of the votes. - - The AccessDecisionVoter interface has three - methods: - - public int vote(Authentication authentication, Object object, ConfigAttributeDefinition config); -public boolean supports(ConfigAttribute attribute); -public boolean supports(Class clazz); - - Concrete implementations return an int, with - possible values being reflected in the - AccessDecisionVoter static fields - ACCESS_ABSTAIN, ACCESS_DENIED - and ACCESS_GRANTED. A voting implementation will - return ACCESS_ABSTAIN if it has no opinion on an - authorization decision. If it does have an opinion, it must return - either ACCESS_DENIED or - ACCESS_GRANTED. - - There are three concrete - AccessDecisionManagers provided with the Acegi - Security System for Spring that tally the votes. The - ConsensusBased implementation will grant or deny - access based on the consensus of non-abstain votes. Properties are - provided to control behavior in the event of an equality of votes or - if all votes are abstain. The AffirmativeBased - implementation will grant access if one or more - ACCESS_GRANTED votes were received (ie a deny vote - will be ignored, provided there was at least one grant vote). Like the - ConsensusBased implementation, there is a parameter - that controls the behavior if all voters abstain. The - UnanimousBased provider expects unanimous - ACCESS_GRANTED votes in order to grant access, - ignoring abstains. It will deny access if there is any - ACCESS_DENIED vote. Like the other implementations, - there is a parameter that controls the behaviour if all voters - abstain. - - It is possible to implement a custom - AccessDecisionManager that tallies votes - differently. For example, votes from a particular - AccessDecisionVoter might receive additional - weighting, whilst a deny vote from a particular voter may have a veto - effect. - - There is one concrete AccessDecisionVoter - implementation provided with the Acegi Security System for Spring. The - RoleVoter class will vote if any ConfigAttribute - begins with ROLE_. It will vote to grant access if - there is a GrantedAuthority which returns a - String representation (via the - getAuthority() method) exactly equal to one or more - ConfigAttributes starting with - ROLE_. If there is no exact match of any - ConfigAttribute starting with - ROLE_, the RoleVoter will vote - to deny access. If no ConfigAttribute begins with - ROLE_, the voter will abstain. - RoleVoter is case sensitive on comparisons as well - as the ROLE_ prefix. - - It is possible to implement a custom - AccessDecisionVoter. Several examples are provided - in the Acegi Security System for Spring unit tests, including - ContactSecurityVoter and - DenyVoter. The - ContactSecurityVoter abstains from voting decisions - where a CONTACT_OWNED_BY_CURRENT_USER - ConfigAttribute is not found. If voting, it queries - the MethodInvocation to extract the owner of the - Contact object that is subject of the method call. - It votes to grant access if the Contact owner - matches the principal presented in the - Authentication object. It could have just as easily - compared the Contact owner with some - GrantedAuthority the - Authentication object presented. All of this is - achieved with relatively few lines of code and demonstrates the - flexibility of the authorization model. - - - - Authorization Tag Library - - The Acegi Security System for Spring comes bundled with a JSP - tag library that eases JSP writing. The tag library is known as - authz. - - This library allows you to easy develop JSP pages which - reference the security environment. For example, - authz allows you to determine if a principal holds - a particular granted authority, holds a group of granted authorities, - or does not hold a given granted authority. - - - Usage - - The following JSP fragment illustrates how to use the - authz taglib: - - <authz:authorize ifAllGranted="ROLE_SUPERVISOR"> - <td> - <A HREF="del.htm?id=<c:out value="${contact.id}"/>">Del</A> - </td> -</authz:authorize> - - This code was copied from the Contacts sample - application. - - What this code says is: if the principal has been granted - ROLE_SUPERVISOR, allow the tag's body to be output. - - - - Installation - - Installation is a simple matter. Simply copy the - acegi-security-taglib.jar file into your - application's WEB-INF/lib folder. The tag library - includes it's TLD, which makes it easier to work with JSP 1.2+ - containers. - - If you are using a JSP 1.1 container, you will need to declare - the JSP tag library in your application's web.xml - file, with code such as this: - - <taglib> - <taglib-uri>http://acegisecurity.sf.net/authz</taglib-uri> - <taglib-location>/WEB-INF/authz.tld</taglib-location> -</taglib> - - For JSP 1.1 containers you will also need to extract the - authz.tld file from the - acegi-security-taglib.jar file and put it into - your application's WEB-INF/lib folder. Use a - regular Zip tool, or Java's JAR utility. - - - - Reference - - The authz:authorize tag declares the - following attributes: - - - - ifAllGranted: All the listed roles - must be granted for the tag to output its body. - - - - ifAnyGranted: Any of the listed roles - must be granted for the tag to output its body. - - - - ifNotGranted: None of the listed - roles must be granted for the tag to output its body. - - - - You'll note that in each attribute you can list multiple - roles. Simply separate the roles using a comma. The - authorize tag ignores whitespace in - attributes. - - The tag library logically ANDs all of it's parameters - together. This means that if you combine two or more attributes, all - attributes must be true for the tag to output it's body. Don't add - an ifAllGranted="ROLE_SUPERVISOR", followed by an - ifNotGranted="ROLE_SUPERVISOR", or you'll be - surprised to never see the tag's body. - - By requiring all attributes to return true, the authorize tag - allows you to create more complex authorization scenarios. For - example, you could declare an - ifAllGranted="ROLE_SUPERVISOR" and an - ifNotGranted="ROLE_NEWBIE_SUPERVISOR" in the same - tag, in order to prevent new supervisors from seeing the tag body. - However it would no doubt be simpler to use - ifAllGranted="ROLE_EXPERIENCED_SUPERVISOR" rather - than inserting NOT conditions into your design. - - One last item: the tag verifies the authorizations in a - specific order: first ifNotGranted, then - ifAllGranted, and finally, - ifAnyGranted. - - - - - Authorization Recommendations - - Given there are several ways to achieve similar authorization - outcomes in the Acegi Security System for Spring, the following - general recommendations are made: - - - - Grant authorities using - GrantedAuthorityImpl where possible. Because it - is already supported by the Acegi Security System for Spring, you - avoid the need to create custom - AuthenticationManager or - AuthenticationProvider implementations simply - to populate the Authentication object with a - custom GrantedAuthority. - - - - Writing an AccessDecisionVoter - implementation and using either ConsensusBased, - AffirmativeBased or - UnanimousBased as the - AccessDecisionManager may be the best approach - to implementing your custom access decision rules. - - - - - - - Run-As Authentication Replacement - - - Purpose - - The AbstractSecurityInterceptor is able to - temporarily replace the Authentication object in - the SecureContext and - ContextHolder during the - SecurityInterceptorCallback. This only occurs if - the original Authentication object was successfully - processed by the AuthenticationManager and - AccessDecisionManager. The - RunAsManager will indicate the replacement - Authentication object, if any, that should be used - during the SecurityInterceptorCallback. - - By temporarily replacing the Authentication - object during a SecurityInterceptorCallback, the - secured invocation will be able to call other objects which require - different authentication and authorization credentials. It will also - be able to perform any internal security checks for specific - GrantedAuthority objects. - - - - Usage - - A RunAsManager interface is provided by the - Acegi Security System for Spring: - - public Authentication buildRunAs(Authentication authentication, Object object, ConfigAttributeDefinition config); -public boolean supports(ConfigAttribute attribute); -public boolean supports(Class clazz); - - The first method returns the Authentication - object that should replace the existing - Authentication object for the duration of the - method invocation. If the method returns null, it - indicates no replacement should be made. The second method is used by - the AbstractSecurityInterceptor as part of its - startup validation of configuration attributes. The - supports(Class) method is called by a security - interceptor implementation to ensure the configured - RunAsManager supports the type of secure object - that the security interceptor will present. - - One concrete implementation of a RunAsManager - is provided with the Acegi Security System for Spring. The - RunAsManagerImpl class returns a replacement - RunAsUserToken if any - ConfigAttribute starts with - RUN_AS_. If any such - ConfigAttribute is found, the replacement - RunAsUserToken will contain the same principal, - credentials and granted authorities as the original - Authentication object, along with a new - GrantedAuthorityImpl for each - RUN_AS_ ConfigAttribute. Each - new GrantedAuthorityImpl will be prefixed with - ROLE_, followed by the RUN_AS - ConfigAttribute. For example, a - RUN_AS_SERVER will result in the replacement - RunAsUserToken containing a - ROLE_RUN_AS_SERVER granted authority. - - The replacement RunAsUserToken is just like - any other Authentication object. It needs to be - authenticated by the AuthenticationManager, - probably via delegation to a suitable - AuthenticationProvider. The - RunAsImplAuthenticationProvider performs such - authentication. It simply accepts as valid any - RunAsUserToken presented. - - To ensure malicious code does not create a - RunAsUserToken and present it for guaranteed - acceptance by the RunAsImplAuthenticationProvider, - the hash of a key is stored in all generated tokens. The - RunAsManagerImpl and - RunAsImplAuthenticationProvider is created in the - bean context with the same key: - - <bean id="runAsManager" class="net.sf.acegisecurity.runas.RunAsManagerImpl"> - <property name="key"><value>my_run_as_password</value></property> -</bean><bean id="runAsAuthenticationProvider" class="net.sf.acegisecurity.runas.RunAsImplAuthenticationProvider"> - <property name="key"><value>my_run_as_password</value></property> -</bean> - - By using the same key, each RunAsUserToken - can be validated it was created by an approved - RunAsManagerImpl. The - RunAsUserToken is immutable after creation for - security reasons. - - - - - User Interfacing with the ContextHolder - - - Purpose - - Everything presented so far assumes one thing: the - ContextHolder is populated with a valid - SecureContext, which in turn contains a valid - Authentication object. Developers are free to do - this in whichever way they like, such as directly calling the relevant - objects at runtime. However, several classes have been provided to - make this process transparent in many situations. - - The net.sf.acegisecurity.ui package is - designed to make interfacing web application user interfaces with the - ContextHolder as simple as possible. There are two - major steps in doing this: - - - - Actually authenticate the user and place the resulting - Authentication object in a "well-known - location". - - - - Extract the Authentication object from - the "well-known location" and place in into the - ContextHolder for the duration of the secure - object invocation. - - - - There are several alternatives are available for the first step, - which will be briefly discussed in this chapter. The most popular - approach is HTTP Session Authentication, which uses the - HttpSession object and filters to authenticate the - user. Another approach is HTTP Basic Authentication, which allows - clients to use HTTP headers to present authentication information to - the Acegi Security System for Spring. Alternatively, you can also use - Yale Central Authentication Service (CAS) for enterprise-wide single - sign on. The final approach is via Container Adapters, which allow - supported web containers to perform the authentication themselves. - HTTP Session and Basic Authentication is discussed below, whilst CAS - and Container Adapters are discussed in separate sections of this - document. - - - - HTTP Session Authentication - - HTTP Session Authentication involves using the - AuthenticationProcessingFilter to process a login - form. The login form simply contains j_username and - j_password input fields, and posts to a URL that is - monitored by the filter (by default - j_acegi_security_check). The filter is defined in - web.xml behind a - FilterToBeanProxy as follows: - - <filter> - <filter-name>Acegi Authentication Processing Filter</filter-name> - <filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class> - <init-param> - <param-name>targetClass</param-name> - <param-value>net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilter</param-value> - </init-param> -</filter> - -<filter-mapping> - <filter-name>Acegi Authentication Processing Filter</filter-name> - <url-pattern>/*</url-pattern> -</filter-mapping> - - For a discussion of FilterToBeanProxy, please - refer to the Filters section. The application context will need to - define the AuthenticationProcessingFilter: - - <bean id="authenticationProcessingFilter" class="net.sf.acegisecurity.ui.webapp.AuthenticationProcessingFilter"> - <property name="authenticationManager"><ref bean="authenticationManager"/></property> - <property name="authenticationFailureUrl"><value>/acegilogin.jsp?login_error=1</value></property> - <property name="defaultTargetUrl"><value>/</value></property> - <property name="filterProcessesUrl"><value>/j_acegi_security_check</value></property> -</bean> - - The configured AuthenticationManager - processes each authentication request. If authentication fails, the - browser will be redirected to the - authenticationFailureUrl. The - AuthenticationException will be placed into the - HttpSession attribute indicated by - AbstractProcessingFilter.ACEGI_SECURITY_LAST_EXCEPTION_KEY, - enabling a reason to be provided to the user on the error page. - - If authentication is successful, the resulting - Authentication object will be placed into the - HttpSession attribute indicated by - HttpSessionIntegrationFilter.ACEGI_SECURITY_AUTHENTICATION_KEY. - This becomes the "well-known location" from which the - Authentication object is later extracted. - - Once the HttpSession has been updated, the - browser will need to be redirected to the target URL. The target URL - is usually indicated by the HttpSession attribute - specified by - AbstractProcessingFilter.ACEGI_SECURITY_TARGET_URL_KEY. - This attribute is automatically set by the - SecurityEnforcementFilter when an - AuthenticationException occurs, so that after login - is completed the user can return to what they were trying to access. - If for some reason the HttpSession does not - indicate the target URL, the browser will be redirected to the - defaultTargetUrl property. - - Because this authentication approach is fully contained within a - single web application, HTTP Session Authentication is recommended to - be used instead of Container Adapters. - - - - HTTP Basic Authentication - - The Acegi Security System for Spring provides a - BasicProcessingFilter which is capable of - processing authentication credentials presented in HTTP headers. This - can be used for authenticating calls made by Spring remoting protocols - (such as Hessian and Burlap), as well as normal user agents (such as - Internet Explorer and Navigator). The standard governing HTTP Basic - Authentication is defined by RFC 1945, Section 11, and the - BasicProcessingFilter conforms with this - RFC. - - To implement HTTP Basic Authentication, it is necessary to add - the following filter to web.xml: - - <filter> - <filter-name>Acegi HTTP BASIC Authorization Filter</filter-name> - <filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class> - <init-param> - <param-name>targetClass</param-name> - <param-value>net.sf.acegisecurity.ui.basicauth.BasicProcessingFilter</param-value> - </init-param> -</filter> - -<filter-mapping> - <filter-name>Acegi HTTP BASIC Authorization Filter</filter-name> - <url-pattern>/*</url-pattern> -</filter-mapping> - - For a discussion of FilterToBeanProxy, please - refer to the Filters section. The application context will need to - define the BasicProcessingFilter and its required - collaborator: - - <bean id="basicProcessingFilter" class="net.sf.acegisecurity.ui.basicauth.BasicProcessingFilter"> - <property name="authenticationManager"><ref bean="authenticationManager"/></property> - <property name="authenticationEntryPoint"><ref bean="authenticationEntryPoint"/></property> -</bean> - -<bean id="authenticationEntryPoint" class="net.sf.acegisecurity.ui.basicauth.BasicProcessingFilterEntryPoint"> - <property name="realmName"><value>Name Of Your Realm</value></property> -</bean> - - The configured AuthenticationManager - processes each authentication request. If authentication fails, the - configured AuthenticationEntryPoint will be used to - retry the authentication process. Usually you will use the - BasicProcessingFilterEntryPoint, which returns a - 401 response with a suitable header to retry HTTP Basic - authentication. If authentication is successful, the resulting - Authentication object will be placed into the - HttpSession attribute indicated by - HttpSessionIntegrationFilter.ACEGI_SECURITY_AUTHENTICATION_KEY. - This becomes the "well-known location" from which the - Authentication object is later extracted. - - If the authentication event was successful, or authentication - was not attempted because the HTTP header did not contain a supported - authentication request, the filter chain will continue as normal. The - only time the filter chain will be interrupted is if authentication - fails and the AuthenticationEntryPoint is called, - as discussed in the previous paragraph. - - HTTP Basic Authentication is recommended to be used instead of - Container Adapters. It can be used in conjunction with HTTP Session - Authentication, as demonstrated in the Contacts sample application. - You can also use it instead of HTTP Session Authentication if you - wish. - - - - Well-Known Location Integration - - Once a web application has used either HTTP Session - Authentication, HTTP Basic Authentication, or a Container Adapter, an - Authentication object will exist in a well-known - location. The final step in automatically integrating the user - interface with the backend security interceptor is to extract this - Authentication object from the well-known location - and place it into a SecureContext in the - ContextHolder. - - The AbstractIntegrationFilter and its - subclasses provide this well-known location integration. These classes - are standard filters, and at the start of each request they will - attempt to extract the Authentication object from a - well-known location. The Authentication object will - then be added to a SecureContext, the - SecureContext associated with the - ContextHolder for the duration of the request, and - the ContextHolder be cleared when the request is - finished. Four concrete subclasses of - AbstractIntegrationFilter are provided with the - Acegi Security System for Spring: - - - - HttpSessionIntegrationFilter is used - with HTTP Session Authentication, HTTP Basic Authentication, or - any other approach that populates the - HttpSession accordingly. It extracts the - Authentication object from the - HttpSession attribute indicated by - HttpSessionIntegrationFilter.ACEGI_SECURITY_AUTHENTICATION_KEY. - - - - HttpRequestIntegrationFilter is used - with Catalina, Jetty and Resin Container Adapters. It extracts - the authentication information from - HttpServletRequest.getUserPrincipal(). - - - - JbossIntegrationFilter is used with the - JBoss Container Adapter. It extracts the authentication from - java:comp/env/security/subject. - - - - AutoIntegrationFilter automatically - determines which filter to use. This makes a web application WAR - file more portable, as the web.xml is not - hard-coded to a specific - AbstractIntegrationFilter. - - - - To define the AutoIntegrationFilter - (recommended), simply add the following to your web.xml: - - <filter> - <filter-name>Acegi Security System for Spring Auto Integration Filter</filter-name> - <filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class> - <init-param> - <param-name>targetClass</param-name> - <param-value>net.sf.acegisecurity.ui.AutoIntegrationFilter</param-value> - </init-param> -</filter> - -<filter-mapping> - <filter-name>Acegi Security System for Spring Auto Integration Filter</filter-name> - <url-pattern>/*</url-pattern> -</filter-mapping> - - You will also need to add the following line to your application - context: - - <bean id="autoIntegrationFilter" class="net.sf.acegisecurity.ui.AutoIntegrationFilter" /> - - Once in the ContextHolder, the standard Acegi - Security System for Spring classes can be used. Because - ContextHolder is a standard object which is - populated using a filter at the container level, JSPs and Servlets do - not need to use Spring's MVC packages. This enables those applications - that use other MVC frameworks to still leverage Spring's other - capabilities, with full authentication and authorization support. The - debug.jsp page provided with the sample application - demonstrates accessing the ContextHolder - independent of Spring's MVC packages. - - - - - Container Adapters - - - Overview - - Early versions of the Acegi Security System for Spring - exclusively used Container Adapters for interfacing authentication - with end users. Whilst this worked well, it required considerable time - to support multiple container versions and the configuration itself - was relatively time-consuming for developers. For this reason the HTTP - Session Authentication and HTTP Basic Authentication approaches were - developed, and are today recommended for most applications. - - Container Adapters enable the Acegi Security System for Spring - to integrate directly with the containers used to host end user - applications. This integration means that applications can continue to - leverage the authentication and authorization capabilities built into - containers (such as isUserInRole() and form-based - or basic authentication), whilst benefiting from the enhanced security - interception capabilities provided by the Acegi Security System for - Spring. - - The integration between a container and the Acegi Security - System for Spring is achieved through an adapter. The adapter provides - a container-compatible user authentication provider, and needs to - return a container-compatible user object. - - The adapter is instantiated by the container and is defined in a - container-specific configuration file. The adapter then loads a Spring - application context which defines the normal authentication manager - settings, such as the authentication providers that can be used to - authenticate the request. The application context is usually named - acegisecurity.xml and is placed in a - container-specific location. - - The Acegi Security System for Spring currently supports Jetty, - Catalina (Tomcat), JBoss and Resin. Additional container adapters can - easily be written. - - - - Adapter Authentication Provider - - As is always the case, the container adapter generated - Authentication object still needs to be - authenticated by an AuthenticationManager when - requested to do so by the - AbstractSecurityInterceptor. The - AuthenticationManager needs to be certain the - adapter-provided Authentication object is valid and - was actually authenticated by a trusted adapter. - - Adapters create Authentication objects which - are immutable and implement the AuthByAdapter - interface. These objects store the hash of a key that is defined by - the adapter. This allows the Authentication object - to be validated by the AuthByAdapterProvider. This - authentication provider is defined as follows: - - <bean id="authByAdapterProvider" class="net.sf.acegisecurity.adapters.AuthByAdapterProvider"> - <property name="key"><value>my_password</value></property> -</bean> - - The key must match the key that is defined in the - container-specific configuration file that starts the adapter. The - AuthByAdapterProvider automatically accepts as - valid any AuthByAdapter implementation that returns - the expected hash of the key. - - To reiterate, this means the adapter will perform the initial - authentication using providers such as - DaoAuthenticationProvider, returning an - AuthByAdapter instance that contains a hash code of - the key. Later, when an application calls a security interceptor - managed resource, the AuthByAdapter instance in the - SecureContext in the - ContextHolder will be tested by the application's - AuthByAdapterProvider. There is no requirement for - additional authentication providers such as - DaoAuthenticationProvider within the - application-specific application context, as the only type of - Authentication instance that will be presented by - the application is from the container adapter. - - Classloader issues are frequent with containers and the use of - container adapters illustrates this further. Each container requires a - very specific configuration. The installation instructions are - provided below. Once installed, please take the time to try the sample - application to ensure your container adapter is properly - configured. - - When using container adapters with the - DaoAuthenticationProvider, ensure you set its - forcePrincipalAsString property to - true. - - - - Catalina (Tomcat) Installation - - The following was tested with Jakarta Tomcat 4.1.30 and 5.0.19. - We automatically test the following directions using our container - integration test system and these versions of Catalina - (Tomcat). - - $CATALINA_HOME refers to the root of your - Catalina (Tomcat) installation. - - Edit your $CATALINA_HOME/conf/server.xml file - so the <Engine> section contains only one - active <Realm> entry. An example realm - entry: - - <Realm className="net.sf.acegisecurity.adapters.catalina.CatalinaAcegiUserRealm" - appContextLocation="conf/acegisecurity.xml" - key="my_password" /> - - Be sure to remove any other <Realm> - entry from your <Engine> section. - - Copy acegisecurity.xml into - $CATALINA_HOME/conf. - - Copy acegi-security-catalina-server.jar into - $CATALINA_HOME/server/lib. - - Copy the following files into - $CATALINA_HOME/common/lib: - - - - aopalliance.jar - - - - spring.jar - - - - acegi-security-catalina-common.jar - - - - commons-codec.jar - - - - burlap.jar - - - - hessian.jar - - - - None of the above JAR files (or - acegi-security.jar) should be in your application's - WEB-INF/lib. The realm name indicated in your - web.xml does not matter with Catalina. - - We have received reports of problems using this Container - Adapter with Mac OS X. A work-around is to use a script such as - follows: - - #!/bin/sh -export CATALINA_HOME="/Library/Tomcat" -export JAVA_HOME="/Library/Java/Home" -cd / -$CATALINA_HOME/bin/startup.sh - - - - Jetty Installation - - The following was tested with Jetty 4.2.18. We automatically - test the following directions using our container integration test - system and this version of Jetty. - - $JETTY_HOME refers to the root of your Jetty - installation. - - Edit your $JETTY_HOME/etc/jetty.xml file so - the <Configure class> section has a new - addRealm call: - - <Call name="addRealm"> - <Arg> - <New class="net.sf.acegisecurity.adapters.jetty.JettyAcegiUserRealm"> - <Arg>Spring Powered Realm</Arg> - <Arg>my_password</Arg> - <Arg>etc/acegisecurity.xml</Arg> - </New> - </Arg> - </Call> - - Copy acegisecurity.xml into - $JETTY_HOME/etc. - - Copy the following files into - $JETTY_HOME/ext: - - aopalliance.jar - - - - commons-logging.jar - - - - spring.jar - - - - acegi-security-jetty-ext.jar - - - - commons-codec.jar - - - - burlap.jar - - - - hessian.jar - - - - None of the above JAR files (or - acegi-security.jar) should be in your application's - WEB-INF/lib. The realm name indicated in your - web.xml does matter with Jetty. The - web.xml must express the same - <realm-name> as your - jetty.xml (in the example above, "Spring Powered - Realm"). - - - - JBoss Installation - - The following was tested with JBoss 3.2.3. We automatically test - the following directions using our container integration test system - and this version of JBoss. - - $JBOSS_HOME refers to the root of your JBoss - installation. - - Edit your - $JBOSS_HOME/server/your_config/conf/login-config.xml - file so that it contains a new entry under the - <Policy> section: - - <application-policy name = "SpringPoweredRealm"> - <authentication> - <login-module code = "net.sf.acegisecurity.adapters.jboss.JbossSpringLoginModule" - flag = "required"> - <module-option name = "appContextLocation">acegisecurity.xml</module-option> - <module-option name = "key">my_password</module-option> - </login-module> - </authentication> - </application-policy> - - Copy acegisecurity.xml into - $JBOSS_HOME/server/your_config/conf. - - Copy the following files into - $JBOSS_HOME/server/your_config/lib: - - aopalliance.jar - - - - spring.jar - - - - acegi-security-jboss-lib.jar - - - - commons-codec.jar - - - - burlap.jar - - - - hessian.jar - - - - None of the above JAR files (or - acegi-security.jar) should be in your application's - WEB-INF/lib. The realm name indicated in your - web.xml does not matter with JBoss. However, your - web application's WEB-INF/jboss-web.xml must - express the same <security-domain> as your - login-config.xml. For example, to match the above - example, your jboss-web.xml would look like - this: - - <jboss-web> - <security-domain>java:/jaas/SpringPoweredRealm</security-domain> -</jboss-web> - - - - Resin Installation - - The following was tested with Resin 3.0.6. - - $RESIN_HOME refers to the root of your Resin - installation. - - Resin provides several ways to support the container adapter. In - the instructions below we have elected to maximise consistency with - other container adapter configurations. This will allow Resin users to - simply deploy the sample application and confirm correct - configuration. Developers comfortable with Resin are naturally able to - use its capabilities to package the JARs with the web application - itself, and/or support single sign-on. - - Copy the following files into - $RESIN_HOME/lib: - - aopalliance.jar - - - - commons-logging.jar - - - - spring.jar - - - - acegi-security-resin-lib.jar - - - - commons-codec.jar - - - - burlap.jar - - - - hessian.jar - - - - Unlike the container-wide acegisecurity.xml - files used by other container adapters, each Resin web application - will contain its own - WEB-INF/resin-acegisecurity.xml file. Each web - application will also contain a resin-web.xml file - which Resin uses to start the container adapter: - - <web-app> - <authenticator> - <type>net.sf.acegisecurity.adapters.resin.ResinAcegiAuthenticator</type> - <init> - <app-context-location>WEB-INF/resin-acegisecurity.xml</app-context-location> - <key>my_password</key> - </init> - </authenticator> -</web-app> - - With the basic configuration provided above, none of the JAR - files listed (or acegi-security.jar) should be in - your application's WEB-INF/lib. The realm name - indicated in your web.xml does not matter with - Resin, as the relevant authentication class is indicated by the - <authenticator> setting. - - - - - Yale Central Authentication Service (CAS) Single Sign On - - - Overview - - Yale University produces an enterprise-wide single sign on - system known as CAS. Unlike other initiatives, Yale's Central - Authentication Service is open source, widely used, simple to - understand, platform independent, and supports proxy capabilities. The - Acegi Security System for Spring fully supports CAS, and provides an - easy migration path from single-application deployments of Acegi - Security through to multiple-application deployments secured by an - enterprise-wide CAS server. - - You can learn more about CAS at - http://www.yale.edu/tp/auth/. You will need to - visit this URL to download the CAS Server files. Whilst the Acegi - Security System for Spring includes two CAS libraries in the - "-with-dependencies" ZIP file, you will still need the CAS Java Server - Pages and web.xml to customise and deploy your CAS - server. - - - - How CAS Works - - Whilst the CAS web site above contains two documents that detail - the architecture of CAS, we present the general overview again here - within the context of the Acegi Security System for Spring. The - following refers to CAS 2.0, being the version of CAS that Acegi - Security System for Spring supports. - - Somewhere in your enterprise you will need to setup a CAS - server. The CAS server is simply a standard WAR file, so there isn't - anything difficult about setting up your server. Inside the WAR file - you will customise the login and other single sign on pages displayed - to users. You will also need to specify in the web.xml a - PasswordHandler. The - PasswordHandler has a simple method that returns a - boolean as to whether a given username and password is valid. Your - PasswordHandler implementation will need to link - into some type of backend authentication repository, such as an LDAP - server or database. - - If you are already running an existing CAS server instance, you - will have already established a PasswordHandler. If - you do not already have a PasswordHandler, you - might prefer to use the Acegi Security System for Spring - CasPasswordHandler class. This class delegates - through to the standard Acegi Security - AuthenticationManager, enabling you to use a - security configuration you might already have in place. You do not - need to use the CasPasswordHandler class on your - CAS server if you do not wish. The Acegi Security System for Spring - will function as a CAS client successfully irrespective of the - PasswordHandler you've chosen for your CAS - server. - - Apart from the CAS server itself, the other key player is of - course the secure web applications deployed throughout your - enterprise. These web applications are known as "services". There are - two types of services: standard services and proxy services. A proxy - service is able to request resources from other services on behalf of - the user. This will be explained more fully later. - - Services can be developed in a large variety of languages, due - to CAS 2.0's very light XML-based protocol. The Yale CAS home page - contains a clients archive which demonstrates CAS clients in Java, - Active Server Pages, Perl, Python and others. Naturally, Java support - is very strong given the CAS server is written in Java. You do not - need to use any of CAS' client classes in applications secured by the - Acegi Security System for Spring. This is handled transparently for - you. - - The basic interaction between a web browser, CAS server and an - Acegi Security for System Spring secured service is as follows: - - - - The web user is browsing the service's public pages. CAS or - Acegi Security is not involved. - - - - The user eventually requests a page that is either secure or - one of the beans it uses is secure. Acegi Security's - SecurityEnforcementFilter will detect the - AuthenticationException. - - - - Because the user's Authentication object - (or lack thereof) caused an - AuthenticationException, the - SecurityEnforcementFilter will call the - configured AuthenticationEntryPoint. If using - CAS, this will be the - CasProcessingFilterEntryPoint class. - - - - The CasProcessingFilterEntry point will - redirect the user's browser to the CAS server. It will also - indicate a service parameter, which is the - callback URL for the Acegi Security service. For example, the URL - to which the browser is redirected might be - https://my.company.com/cas/login?service=https%3A%2F%2Fserver3.company.com%2Fwebapp%2Fj_acegi_cas_security_check. - - - - After the user's browser redirects to CAS, they will be - prompted for their username and password. If the user presents a - session cookie which indicates they've previously logged on, they - will not be prompted to login again (there is an exception to this - procedure, which we'll cover later). CAS will use the - PasswordHandler discussed above to decide - whether the username and password is valid. - - - - Upon successful login, CAS will redirect the user's browser - back to the original service. It will also include a - ticket parameter, which is an opaque string - representing the "service ticket". Continuing our earlier example, - the URL the browser is redirected to might be - https://server3.company.com/webapp/j_acegi_cas_security_check?ticket=ST-0-ER94xMJmn6pha35CQRoZ. - - - - Back in the service web application, the - CasProcessingFilter is always listening for - requests to /j_acegi_cas_security_check (this - is configurable, but we'll use the defaults in this introduction). - The processing filter will construct a - UsernamePasswordAuthenticationToken - representing the service ticket. The principal will be equal to - CasProcessingFilter.CAS_STATEFUL_IDENTIFIER, - whilst the credentials will be the service ticket opaque value. - This authentication request will then be handed to the configured - AuthenticationManager. - - - - The AuthenticationManager implementation - will be the ProviderManager, which is in turn - configured with the CasAuthenticationProvider. - The CasAuthenticationProvider only responds to - UsernamePasswordAuthenticationTokens containing - the CAS-specific principal (such as - CasProcessingFilter.CAS_STATEFUL_IDENTIFIER) - and CasAuthenticationTokens (discussed - later). - - - - CasAuthenticationProvider will validate - the service ticket using a TicketValidator - implementation. Acegi Security includes one implementation, the - CasProxyTicketValidator. This implementation a - ticket validation class included in the CAS client library. The - CasProxyTicketValidator makes a HTTPS request - to the CAS server in order to validate the service ticket. The - CasProxyTicketValidator may also include a - proxy callback URL, which is included in this example: - https://my.company.com/cas/proxyValidate?service=https%3A%2F%2Fserver3.company.com%2Fwebapp%2Fj_acegi_cas_security_check&ticket=ST-0-ER94xMJmn6pha35CQRoZ&pgtUrl=https://server3.company.com/webapp/casProxy/receptor. - - - - Back on the CAS server, the proxy validation request will be - received. If the presented service ticket matches the service URL - the ticket was issued to, CAS will provide an affirmative response - in XML indicating the username. If any proxy was involved in the - authentication (discussed below), the list of proxies is also - included in the XML response. - - - - [OPTIONAL] If the request to the CAS validation service - included the proxy callback URL (in the pgtUrl - parameter), CAS will include a pgtIou string in - the XML response. This pgtIou represents a - proxy-granting ticket IOU. The CAS server will then create its own - HTTPS connection back to the pgtUrl. This is to - mutually authenticate the CAS server and the claimed service URL. - The HTTPS connection will be used to send a proxy granting ticket - to the original web application. For example, - https://server3.company.com/webapp/casProxy/receptor?pgtIou=PGTIOU-0-R0zlgrl4pdAQwBvJWO3vnNpevwqStbSGcq3vKB2SqSFFRnjPHt&pgtId=PGT-1-si9YkkHLrtACBo64rmsi3v2nf7cpCResXg5MpESZFArbaZiOKH. - We suggest you use CAS' ProxyTicketReceptor - servlet to receive these proxy-granting tickets, if they are - required. - - - - The CasProxyTicketValidator will parse - the XML received from the CAS server. It will return to the - CasAuthenticationProvider a - TicketResponse, which includes the username - (mandatory), proxy list (if any were involved), and proxy-granting - ticket IOU (if the proxy callback was requested). - - - - Next CasAuthenticationProvider will call - a configured CasProxyDecider. The - CasProxyDecider indicates whether the proxy - list in the TicketResponse is acceptable to the - service. Several implementations are provided with the Acegi - Security System: RejectProxyTickets, - AcceptAnyCasProxy and - NamedCasProxyDecider. These names are largely - self-explanatory, except NamedCasProxyDecider - which allows a List of trusted proxies to be - provided. - - - - CasAuthenticationProvider will next - request a CasAuthoritiesPopulator to advise the - GrantedAuthority objects that apply to the user - contained in the TicketResponse. Acegi Security - includes a DaoCasAuthoritiesPopulator which - simply uses the AuthenticationDao - infrastructure to find the UserDetails and - their associated GrantedAuthoritys. Note that - the password and enabled/disabled status of - UserDetails returned by the - AuthenticationDao are ignored, as the CAS - server is responsible for authentication decisions. - DaoCasAuthoritiesPopulator is only concerned - with retrieving the GrantedAuthoritys. - - - - If there were no problems, - CasAuthenticationProvider constructs a - CasAuthenticationToken including the details - contained in the TicketResponse and the - GrantedAuthoritys. The - CasAuthenticationToken contains the hash of a - key, so that the CasAuthenticationProvider - knows it created it. - - - - Control then returns to - CasProcessingFilter, which places the created - CasAuthenticationToken into the - HttpSession attribute named - HttpSessionIntegrationFilter.ACEGI_SECURITY_AUTHENTICATION_KEY. - - - - The user's browser is redirected to the original page that - caused the AuthenticationException. - - - - As the Authentication object is now in - the well-known location, it is handled like any other - authentication approach. Usually the - AutoIntegrationFilter will be used to associate - the Authentication object with the - ContextHolder for the duration of each - request. - - - - It's good that you're still here! It might sound involved, but - you can relax as the Acegi Security System for Spring classes hide - much of the complexity. Let's now look at how this is - configured. - - - - CAS Server Installation (Optional) - - As mentioned above, the Acegi Security System for Spring - includes a PasswordHandler that bridges your - existing AuthenticationManager into CAS. You do not - need to use this PasswordHandler to use Acegi - Security on the client side (any CAS - PasswordHandler will do). - - To install, you will need to download and extract the CAS server - archive. We used version 2.0.12. There will be a - /web directory in the root of the deployment. Copy - an applicationContext.xml containing your - AuthenticationManager as well as the - CasPasswordHandler into the - /web/WEB-INF directory. A sample - applicationContext.xml is included below: - - <bean id="inMemoryDaoImpl" class="net.sf.acegisecurity.providers.dao.memory.InMemoryDaoImpl"> - <property name="userMap"> - <value> - marissa=koala,ROLES_IGNORED_BY_CAS - dianne=emu,ROLES_IGNORED_BY_CAS - scott=wombat,ROLES_IGNORED_BY_CAS - peter=opal,disabled,ROLES_IGNORED_BY_CAS - </value> - </property> -</bean> - -<bean id="daoAuthenticationProvider" class="net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider"> - <property name="authenticationDao"><ref bean="inMemoryDaoImpl"/></property> -</bean> - -<bean id="authenticationManager" class="net.sf.acegisecurity.providers.ProviderManager"> - <property name="providers"> - <list> - <ref bean="daoAuthenticationProvider"/> - </list> - </property> -</bean> - -<bean id="casPasswordHandler" class="net.sf.acegisecurity.adapters.cas.CasPasswordHandler"> - <property name="authenticationManager"><ref bean="authenticationManager"/></property> -</bean> - - Note the granted authorities are ignored by CAS because it has - no way of communicating the granted authorities to calling - applications. CAS is only concerned with username and passwords (and - the enabled/disabled status). - - Next you will need to edit the existing - /web/WEB-INF/web.xml file. Add (or edit in the case - of the authHandler property) the following - lines: - - <context-param> - <param-name>edu.yale.its.tp.cas.authHandler</param-name> - <param-value>net.sf.acegisecurity.adapters.cas.CasPasswordHandlerProxy</param-value> -</context-param> - -<context-param> - <param-name>contextConfigLocation</param-name> - <param-value>/WEB-INF/applicationContext.xml</param-value> -</context-param> - -<listener> - <listener-class>org.springframework.web.context.ContextLoaderListener</listener-class> -</listener> - - Copy the spring.jar and - acegi-security.jar files into - /web/WEB-INF/lib. Now use the ant - dist task in the build.xml in the root of - the directory structure. This will create - /lib/cas.war, which is ready for deployment to your - servlet container. - - Note CAS heavily relies on HTTPS. You can't even test the system - without a HTTPS certificate. Whilst you should refer to your web - container's documentation on setting up HTTPS, if you need some - additional help or a test certificate you might like to check the - samples/contacts/etc/ssl directory. - - - - CAS Acegi Security System Client Installation - - The web application side of CAS is made easy due to the Acegi - Security System for Spring. It is assumed you already know the basics - of using the Acegi Security System for Spring, so these are not - covered again below. Only the CAS-specific beans are mentioned. - - You will need to add a ServiceProperties bean - to your application context. This represents your service: - - <bean id="serviceProperties" class="net.sf.acegisecurity.ui.cas.ServiceProperties"> - <property name="service"><value>https://localhost:8443/contacts-cas/j_acegi_cas_security_check</value></property> - <property name="sendRenew"><value>false</value></property> -</bean> - - The service must equal a URL that will be - monitored by the CasProcessingFilter. The - sendRenew defaults to false, but should be set to - true if your application is particularly sensitive. What this - parameter does is tell the CAS login service that a single sign on - login is unacceptable. Instead, the user will need to re-enter their - username and password in order to gain access to the service. - - The following beans should be configured to commence the CAS - authentication process: - - <bean id="casProcessingFilter" class="net.sf.acegisecurity.ui.cas.CasProcessingFilter"> - <property name="authenticationManager"><ref bean="authenticationManager"/></property> - <property name="authenticationFailureUrl"><value>/casfailed.jsp</value></property> - <property name="defaultTargetUrl"><value>/</value></property> - <property name="filterProcessesUrl"><value>/j_acegi_cas_security_check</value></property> -</bean> - -<bean id="securityEnforcementFilter" class="net.sf.acegisecurity.intercept.web.SecurityEnforcementFilter"> - <property name="filterSecurityInterceptor"><ref bean="filterInvocationInterceptor"/></property> - <property name="authenticationEntryPoint"><ref bean="casProcessingFilterEntryPoint"/></property> -</bean> - -<bean id="casProcessingFilterEntryPoint" class="net.sf.acegisecurity.ui.cas.CasProcessingFilterEntryPoint"> - <property name="loginUrl"><value>https://localhost:8443/cas/login</value></property> - <property name="serviceProperties"><ref bean="serviceProperties"/></property> -</bean> - - You will also need to add the - CasProcessingFilter to web.xml: - - <filter> - <filter-name>Acegi CAS Processing Filter</filter-name> - <filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class> - <init-param> - <param-name>targetClass</param-name> - <param-value>net.sf.acegisecurity.ui.cas.CasProcessingFilter</param-value> - </init-param> -</filter> - -<filter-mapping> - <filter-name>Acegi CAS Processing Filter</filter-name> - <url-pattern>/*</url-pattern> -</filter-mapping> - - The CasProcessingFilter has very similar - properties to the AuthenticationProcessingFilter - (used for form-based logins). Each property is - self-explanatory. - - For CAS to operate, the - SecurityEnforcementFilter must have its - authenticationEntryPoint property set to the - CasProcessingFilterEntryPoint bean. - - The CasProcessingFilterEntryPoint must refer - to the ServiceProperties bean (discussed above), - which provides the URL to the enterprise's CAS login server. This is - where the user's browser will be redirected. - - Next you need to add an AuthenticationManager - that uses CasAuthenticationProvider and its - collaborators: - - <bean id="authenticationManager" class="net.sf.acegisecurity.providers.ProviderManager"> - <property name="providers"> - <list> - <ref bean="casAuthenticationProvider"/> - </list> - </property> -</bean> - -<bean id="casAuthenticationProvider" class="net.sf.acegisecurity.providers.cas.CasAuthenticationProvider"> - <property name="casAuthoritiesPopulator"><ref bean="casAuthoritiesPopulator"/></property> - <property name="casProxyDecider"><ref bean="casProxyDecider"/></property> - <property name="ticketValidator"><ref bean="casProxyTicketValidator"/></property> - <property name="statelessTicketCache"><ref bean="statelessTicketCache"/></property> - <property name="key"><value>my_password_for_this_auth_provider_only</value></property> -</bean> - -<bean id="casProxyTicketValidator" class="net.sf.acegisecurity.providers.cas.ticketvalidator.CasProxyTicketValidator"> - <property name="casValidate"><value>https://localhost:8443/cas/proxyValidate</value></property> - <property name="proxyCallbackUrl"><value>https://localhost:8443/contacts-cas/casProxy/receptor</value></property> - <property name="serviceProperties"><ref bean="serviceProperties"/></property> - <!-- <property name="trustStore"><value>/some/path/to/your/lib/security/cacerts</value></property> --> -</bean> - -<bean id="statelessTicketCache" class="net.sf.acegisecurity.providers.cas.cache.EhCacheBasedTicketCache"> - <property name="minutesToIdle"><value>20</value></property> -</bean> - -<bean id="casAuthoritiesPopulator" class="net.sf.acegisecurity.providers.cas.populator.DaoCasAuthoritiesPopulator"> - <property name="authenticationDao"><ref bean="inMemoryDaoImpl"/></property> -</bean> - -<bean id="casProxyDecider" class="net.sf.acegisecurity.providers.cas.proxy.RejectProxyTickets"/> - - The beans are all reasonable self-explanatory if you refer back - to the "How CAS Works" section. Careful readers might notice one - surprise: the statelessTicketCache property of the - CasAuthenticationProvider. This is discussed in - detail in the "Advanced CAS Usage" section. - - Note the CasProxyTicketValidator has a - remarked out trustStore property. This property - might be helpful if you experience HTTPS certificate issues. Also note - the proxyCallbackUrl is set so the service can - receive a proxy-granting ticket. As mentioned above, this is optional - and unnecessary if you do not require proxy-granting tickets. If you - do use this feature, you will need to configure a suitable servlet to - receive the proxy-granting tickets. We suggest you use CAS' - ProxyTicketReceptor by adding the following to your - web application's web.xml: - - <servlet> - <servlet-name>casproxy</servlet-name> - <servlet-class>edu.yale.its.tp.cas.proxy.ProxyTicketReceptor</servlet-class> -</servlet> - -<servlet-mapping> - <servlet-name>casproxy</servlet-name> - <url-pattern>/casProxy/*</url-pattern> -</servlet-mapping> - - This completes the configuration of CAS. If you haven't made any - mistakes, your web application should happily work within the - framework of CAS single sign on. No other parts of the Acegi Security - System for Spring need to be concerned about the fact CAS handled - authentication. - - There is also a contacts-cas.war file in the - sample applications directory. This sample application uses the above - settings and can be deployed to see CAS in operation. - - - - Advanced CAS Usage - - The CasAuthenticationProvider distinguishes - between stateful and stateless clients. A stateful client is - considered any that originates via the - CasProcessingFilter. A stateless client is any that - presents an authentication request via the - UsernamePasswordAuthenticationToken with a - principal equal to - CasProcessingFilter.CAS_STATELESS_IDENTIFIER. - - Stateless clients are likely to be via remoting protocols such - as Hessian and Burlap. The BasicProcessingFilter is - still used in this case, but the remoting protocol client is expected - to present a username equal to the static string above, and a password - equal to a CAS service ticket. Clients should acquire a CAS service - ticket directly from the CAS server. - - Because remoting protocols have no way of presenting themselves - within the context of a HttpSession, it isn't - possible to rely on the HttpSession's - HttpSessionIntegrationFilter.ACEGI_SECURITY_AUTHENTICATION_KEY - attribute to locate the CasAuthenticationToken. - Furthermore, because the CAS server invalidates a service ticket after - it has been validated by the TicketValidator, - presenting the same service ticket on subsequent requests will not - work. It is similarly very difficult to obtain a proxy-granting ticket - for a remoting protocol client, as they are often deployed on client - machines which rarely have HTTPS URLs that would be accessible to the - CAS server. - - One obvious option is to not use CAS at all for remoting - protocol clients. However, this would eliminate many of the desirable - features of CAS. - - As a middle-ground, the - CasAuthenticationProvider uses a - StatelessTicketCache. This is used solely for - requests with a principal equal to - CasProcessingFilter.CAS_STATELESS_IDENTIFIER. What - happens is the CasAuthenticationProvider will store - the resulting CasAuthenticationToken in the - StatelessTicketCache, keyed on the service ticket. - Accordingly, remoting protocol clients can present the same service - ticket and the CasAuthenticationProvider will not - need to contact the CAS server for validation (aside from the first - request). - - The other aspect of advanced CAS usage involves creating proxy - tickets from the proxy-granting ticket. As indicated above, we - recommend you use CAS' ProxyTicketReceptor to - receive these tickets. The ProxyTicketReceptor - provides a static method that enables you to obtain a proxy ticket by - presenting the proxy-granting IOU ticket. You can obtain the - proxy-granting IOU ticket by calling - CasAuthenticationToken.getProxyGrantingTicketIou(). - - It is hoped you find CAS integration easy and useful with the - Acegi Security System for Spring classes. Welcome to enterprise-wide - single sign on! - - - - - Channel Security - - - Overview - - In addition to coordinating the authentication and authorization - requirements of your application, the Acegi Security System for Spring - is also able to ensure unauthenticated web requests have certain - properties. These properties may include being of a particular - transport type, having a particular HttpSession - attribute set and so on. The most common requirement is for your web - requests to be received using a particular transport protocol, such as - HTTPS. - - An important issue in considering transport security is that of - session hijacking. Your web container manages a - HttpSession by reference to a - jsessionid that is sent to user agents either via a - cookie or URL rewriting. If the jsessionid is ever - sent over HTTP, there is a possibility that session identifier can be - intercepted and used to impersonate the user after they complete the - authentication process. This is because most web containers maintain - the same session identifier for a given user, even after they switch - from HTTP to HTTPS pages. - - If session hijacking is considered too significant a risk for - your particular application, the only option is to use HTTPS for every - request. This means the jsessionid is never sent - across an insecure channel. You will need to ensure your - web.xml-defined - <welcome-file> points to a HTTPS location, - and the application never directs the user to a HTTP location. The - Acegi Security System for Spring provides a solution to assist with - the latter. - - - - Configuration - - To utilise Acegi Security's channel security services, add the - following lines to web.xml: - - <filter> - <filter-name>Acegi Channel Processing Filter</filter-name> - <filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class> - <init-param> - <param-name>targetClass</param-name> - <param-value>net.sf.acegisecurity.securechannel.ChannelProcessingFilter</param-value> - </init-param> -</filter> - -<filter-mapping> - <filter-name>Acegi Channel Processing Filter</filter-name> - <url-pattern>/*</url-pattern> -</filter-mapping> - - As usual when running FilterToBeanProxy, you - will also need to configure the filter in your application - context: - - <bean id="channelProcessingFilter" class="net.sf.acegisecurity.securechannel.ChannelProcessingFilter"> - <property name="channelDecisionManager"><ref bean="channelDecisionManager"/></property> - <property name="filterInvocationDefinitionSource"> - <value> - CONVERT_URL_TO_LOWERCASE_BEFORE_COMPARISON - \A/secure/.*\Z=REQUIRES_SECURE_CHANNEL - \A/acegilogin.jsp.*\Z=REQUIRES_SECURE_CHANNEL - \A/j_acegi_security_check.*\Z=REQUIRES_SECURE_CHANNEL - \A.*\Z=REQUIRES_INSECURE_CHANNEL - </value> - </property> -</bean> - -<bean id="channelDecisionManager" class="net.sf.acegisecurity.securechannel.ChannelDecisionManagerImpl"> - <property name="channelProcessors"> - <list> - <ref bean="secureChannelProcessor"/> - <ref bean="insecureChannelProcessor"/> - </list> - </property> -</bean> - -<bean id="secureChannelProcessor" class="net.sf.acegisecurity.securechannel.SecureChannelProcessor"/> -<bean id="insecureChannelProcessor" class="net.sf.acegisecurity.securechannel.InsecureChannelProcessor"/> - - Like FilterSecurityInterceptor, Apache Ant - style paths are also supported by the - ChannelProcessingFilter. - - The ChannelProcessingFilter operates by - filtering all web requests and determining the configuration - attributes that apply. It then delegates to the - ChannelDecisionManager. The default implementation, - ChannelDecisionManagerImpl, should suffice in most - cases. It simply delegates through the list of configured - ChannelProcessor instances. A - ChannelProcessor will review the request, and if it - is unhappy with the request (eg it was received across the incorrect - transport protocol), it will perform a redirect, throw an exception or - take whatever other action is appropriate. - - Included with the Acegi Security System for Spring are two - concrete ChannelProcessor implementations: - SecureChannelProcessor ensures requests with a - configuration attribute of REQUIRES_SECURE_CHANNEL - are received over HTTPS, whilst - InsecureChannelProcessor ensures requests with a - configuration attribute of - REQUIRES_INSECURE_CHANNEL are received over HTTP. - Both implementations delegate to a - ChannelEntryPoint if the required transport - protocol is not used. The two ChannelEntryPoint - implementations included with Acegi Security simply redirect the - request to HTTP and HTTPS as appropriate. Appropriate defaults are - assigned to the ChannelProcessor implementations - for the configuration attribute keywords they respond to and the - ChannelEntryPoint they delegate to, although you - have the ability to override these using the application - context. - - Note that the redirections are absolute (eg - http://www.company.com:8080/app/page), not relative (eg /app/page). - During testing it was discovered that Internet Explorer 6 Service Pack - 1 has a bug whereby it does not respond correctly to a redirection - instruction which also changes the port to use. Accordingly, absolute - URLs are used in conjunction with bug detection logic in the - PortResolverImpl that is wired up by default to - many Acegi Security beans. Please refer to the JavaDocs for - PortResolverImpl for further details. - - - - Usage - - Once configured, using the channel security filter is very easy. - Simply request pages without regard to the protocol (ie HTTP or HTTPS) - or port (eg 80, 8080, 443, 8443 etc). Obviously you'll still need a - way of making the initial request (probably via the - web.xml <welcome-file> or - a well-known home page URL), but once this is done the filter will - perform redirects as defined by your application context. - - You can also add your own ChannelProcessor - implementations to the ChannelDecisionManagerImpl. - For example, you might set a HttpSession attribute - when a human user is detected via a "enter the contents of this - graphic" procedure. Your ChannelProcessor would - respond to say REQUIRES_HUMAN_USER configuration - attributes and redirect to an appropriate entry point to start the - human user validation process if the HttpSession - attribute is not currently set. - - To decide whether a security check belongs in a - ChannelProcessor or an - AccessDecisionVoter, remember that the former is - designed to handle unauthenticated requests, whilst the latter is - designed to handle authenticated requests. The latter therefore has - access to the granted authorities of the authenticated principal. In - addition, problems detected by a ChannelProcessor - will generally cause a HTTP/HTTPS redirection so its requirements can - be met, whilst problems detected by an - AccessDecisionVoter will ultimately result in an - AccessDeniedException (depending on the governing - AccessDecisionManager). - - - - - Instance-Based Access Control List (ACL) Security - - - Overview - - THIS FEATURE WAS ADDED IN VERSION 0.6. WE WELCOME YOUR COMMENTS - AND IMPROVEMENTS. - - Complex applications often will find the need to define access - permissions not simply at a web request or method invocation level. - Instead, security decisions need to comprise both who - (Authentication), where - (MethodInvocation) and what - (SomeDomainObject). In other words, authorization - decisions also need to consider the actual domain object instance - subject of a method invocation. - - Imagine you're designing an application for a pet clinic. There - will be two main groups of users of your Spring-based application: - staff of the pet clinic, as well as the pet clinic's customers. The - staff will have access to all of the data, whilst your customers will - only be able to see their own customer records. To make it a little - more interesting, your customers can allow other users to see their - customer records, such as their "puppy preschool "mentor or president - of their local "Pony Club". Using Acegi Security System for Spring as - the foundation, you have several approaches that can be - used: - - Write your business methods to enforce the security. You - could consult a collection within the - Customer domain object instance to determine - which users have access. By using the - ContextHolder.getContext() and casting it to - SecureContext, you'll be able to access the - Authentication object. - - - - Write an AccessDecisionVoter to enforce - the security from the GrantedAuthority[]s - stored in the Authentication object. This - would mean your AuthenticationManager would - need to populate the Authentication with - custom GrantedAuthority[]s representing each - of the Customer domain object instances the - principal has access to. - - - - Write an AccessDecisionVoter to enforce - the security and open the target Customer - domain object directly. This would mean your voter needs access - to a DAO that allows it to retrieve the - Customer object. It would then access the - Customer object's collection of approved - users and make the appropriate decision. - - - - Each one of these approaches is perfectly legitimate. However, - the first couples your authorization checking to your business code. - The main problems with this include the enhanced difficulty of unit - testing and the fact it would be more difficult to reuse the - Customer authorization logic elsewhere. Obtaining - the GrantedAuthority[]s from the - Authentication object is also fine, but will not - scale to large numbers of Customers. If a user - might be able to access 5,000 Customers (unlikely - in this case, but imagine if it were a popular vet for a large Pony - Club!) the amount of memory consumed and time required to construct - the Authentication object would be undesirable. The - final method, opening the Customer directly from - external code, is probably the best of the three. It achieves - separation of concerns, and doesn't misuse memory or CPU cycles, but - it is still inefficient in that both the - AccessDecisionVoter and the eventual business - method itself will perform a call to the DAO responsible for - retrieving the Customer object. Two accesses per - method invocation is clearly undesirable. In addition, with every - approach listed you'll need to write your own access control list - (ACL) persistence and business logic from scratch. - - Fortunately, there is another alternative, which we'll talk - about below. - - - - The net.sf.acegisecurity.acl Package - - The net.sf.acegisecurity.acl package is very - simple, comprising only a handful of interfaces and a single class. It - provides the basic foundation for access control list (ACL) lookups. - The central interface is AclManager, which is - defined by two methods: - - public AclEntry[] getAcls(java.lang.Object domainInstance); -public AclEntry[] getAcls(java.lang.Object domainInstance, Authentication authentication); - - AclManager is intended to be used as a - collaborator against your business objects, or, more desirably, - AccessDecisionVoters. This means you use Spring's - normal ApplicationContext features to wire up your - AccessDecisionVoter (or business method) with an - AclManager. Consideration was given to placing the - ACL information in the ContextHolder, but it was - felt this would be inefficient both in terms of memory usage as well - as the time spent loading potentially unused ACL information. The - trade-off of needing to wire up a collaborator for those objects - requiring ACL information is rather minor, particularly in a - Spring-managed application. - - The first method of the AclManager will - return all ACLs applying to the domain object instance passed to it. - The second method does the same, but only returns those ACLs which - apply to the passed Authentication object. - - The AclEntry interface returned by - AclManager is merely a marker interface. You will - need to provide an implementation that reflects that ACL permissions - for your application. - - Rounding out the net.sf.acegisecurity.acl - package is an AclProviderManager class, with a - corresponding AclProvider interface. - AclProviderManager is a concrete implementation of - AclManager, which iterates through registered - AclProviders. The first - AclProvider that indicates it can authoritatively - provide ACL information for the presented domain object instance will - be used. This is very similar to the - AuthenticationProvider interface used for - authentication. - - With this background, let's now look at a usable ACL - implementation. - - - - Integer Masked ACLs - - Acegi Security System for Spring includes a production-quality - ACL provider implementation. The implementation is based on integer - masking, which is commonly used for ACL permissions given its - flexibility and speed. Anyone who has used Unix's - chmod command will know all about this type of - permission masking (eg chmod 777). You'll find the - classes and interfaces for the integer masking ACL package under - net.sf.acegisecurity.acl.basic. - - Extending the AclEntry interface is a - BasicAclEntry interface, with the main methods - shown below: - - public AclObjectIdentity getAclObjectIdentity(); -public AclObjectIdentity getAclObjectParentIdentity(); -public int getMask(); -public java.lang.Object getRecipient(); - - As shown, each BasicAclEntry has four main - properties. The mask is the integer that represents - the permissions granted to the recipient. The - aclObjectIdentity is able to identify the domain - object instance for which the ACL applies, and the - aclObjectParentIdentity optionally specifies the - parent of the domain object instance. Multiple - BasicAclEntrys usually exist against a single - domain object instance, and as suggested by the parent identity - property, permissions granted higher in the object hierarchy will - trickle down and be inherited (unless blocked by integer zero). - - BasicAclEntry implementations typically - provide convenience methods, such as - isReadAllowed(), to avoid application classes - needing to perform bit masking themselves. The - SimpleAclEntry and - AbstractBasicAclEntry demonstrate and provide much - of this bit masking logic. - - The AclObjectIdentity itself is merely a - marker interface, so you need to provide implementations for your - domain objects. However, the package does include a - NamedEntityObjectIdentity implementation which will - suit many needs. The NamedEntityObjectIdentity - identifies a given domain object instance by the classname of the - instance and the identity of the instance. A - NamedEntityObjectIdentity can be constructed - manually (by calling the constructor and providing the classname and - identity Strings), or by passing in any domain - object that contains a getId() method. - - The actual AclProvider implementation is - named BasicAclProvider. It has adopted a similar - design to that used by the authentication-related - DaoAuthenticationProvder. Specifically, you define - a BasicAclDao against the provider, so different - ACL repository types can be accessed in a pluggable manner. The - BasicAclProvider also supports pluggable cache - providers (with Acegi Security System for Spring including an - implementation that fronts EH-CACHE). - - The BasicAclDao interface is very simple to - implement: - - public BasicAclEntry[] getAcls(AclObjectIdentity aclObjectIdentity); - - A BasicAclDao implementation needs to - understand the presented AclObjectIdentity and how - it maps to a storage repository, find the relevant records, and create - appropriate BasicAclEntry objects and return - them. - - Acegi Security includes a single BasicAclDao - implementation called JdbcDaoImpl. As implied by - the name, it accesses ACL information from a JDBC database. The - default database schema and some sample data will aid in understanding - its function: - - CREATE TABLE acl_object_identity ( - id IDENTITY NOT NULL, - object_identity VARCHAR_IGNORECASE(250) NOT NULL, - parent_object INTEGER, - acl_class VARCHAR_IGNORECASE(250) NOT NULL, - CONSTRAINT unique_object_identity UNIQUE(object_identity), - FOREIGN KEY (parent_object) REFERENCES acl_object_identity(id) -); - -CREATE TABLE acl_permission ( - id IDENTITY NOT NULL, - acl_object_identity INTEGER NOT NULL, - recipient VARCHAR_IGNORECASE(100) NOT NULL, - mask INTEGER NOT NULL, - CONSTRAINT unique_recipient UNIQUE(acl_object_identity, recipient), - FOREIGN KEY (acl_object_identity) REFERENCES acl_object_identity(id) -); - -INSERT INTO acl_object_identity VALUES (1, 'corp.DomainObject:1', null, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry'); -INSERT INTO acl_object_identity VALUES (2, 'corp.DomainObject:2', 1, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry'); -INSERT INTO acl_object_identity VALUES (3, 'corp.DomainObject:3', 1, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry'); -INSERT INTO acl_object_identity VALUES (4, 'corp.DomainObject:4', 1, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry'); -INSERT INTO acl_object_identity VALUES (5, 'corp.DomainObject:5', 3, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry'); -INSERT INTO acl_object_identity VALUES (6, 'corp.DomainObject:6', 3, 'net.sf.acegisecurity.acl.basic.SimpleAclEntry'); - -INSERT INTO acl_permission VALUES (null, 1, 'ROLE_SUPERVISOR', 1); -INSERT INTO acl_permission VALUES (null, 2, 'ROLE_SUPERVISOR', 0); -INSERT INTO acl_permission VALUES (null, 2, 'marissa', 2); -INSERT INTO acl_permission VALUES (null, 3, 'scott', 14); -INSERT INTO acl_permission VALUES (null, 6, 'scott', 1); - - As can be seen, database-specific constraints are used - extensively to ensure the integrity of the ACL information. If you - need to use a different database (Hypersonic SQL statements are shown - above), you should try to implement equivalent constraints. - - The JdbcDaoImpl will only respond to requests - for NamedEntityObjectIdentitys. It converts such - identities into a single String, comprising - the NamedEntityObjectIdentity.getClassname() + - ":" + - NamedEntityObjectIdentity.getId(). This yields the - type of object_identity values shown above. As - indicated by the sample data, each database row corresponds to a - single BasicAclEntry. As stated earlier and - demonstrated by corp.DomainObject:2 in the above - sample data, each domain object instance will often have multiple - BasicAclEntry[]s. - - As JdbcDaoImpl is required to return concrete - BasicAclEntry classes, it needs to know which - BasicAclEntry implementation it is to create and - populate. This is the role of the acl_class column. - JdbcDaoImpl will create the indicated class and set - its mask, recipient, - aclObjectIdentity and - aclObjectParentIdentity properties. - - As you can probably tell from the sample data, the - parent_object_identity value can either be null or - in the same format as the object_identity. If - non-null, JdbcDaoImpl will create a - NamedEntityObjectIdentity to place inside the - returned BasicAclEntry class. - - Returning to the BasicAclProvider, before it - can poll the BasicAclDao implementation it needs to - convert the domain object instance it was passed into an - AclObjectIdentity. - BasicAclProvider has a protected - AclObjectIdentity obtainIdentity(Object domainInstance) - method that is responsible for this. As a protected method, it enables - subclasses to easily override. The normal implementation checks - whether the passed domain object instance implements the - AclObjectIdentityAware interface, which is merely a - getter for an AclObjectIdentity. If the domain - object does implement this interface, that is the identity returned. - If the domain object does not implement this interface, the method - will attempt to create an AclObjectIdentity by - passing the domain object instance to the constructor of a class - defined by the - BasicAclProvider.getDefaultAclObjectIdentity() - method. By default the defined class is - NamedEntityObjectIdentity, which was described in - more detail above. Therefore, you will need to either (i) provide a - getId() method on your domain objects, (ii) - implement AclObjectIdentityAware on your domain - objects, (iii) provide an alternative - AclObjectIdentity implementation that will accept - your domain object in its constructor, or (iv) override the - obtainIdentity(Object) method. - - Once the AclObjectIdentity of the domain - object instance is determined, the BasicAclProvider - will poll the DAO to obtain its BasicAclEntry[]s. - If any of the entries returned by the DAO indicate there is a parent, - that parent will be polled, and the process will repeat until there is - no further parent. The permissions assigned to a - recipient closest to the domain object instance - will always take priority and override any inherited permissions. From - the sample data above, the following inherited permissions would - apply: - - --- Mask integer 0 = no permissions ---- Mask integer 1 = administer ---- Mask integer 2 = read ---- Mask integer 6 = read and write permissions ---- Mask integer 14 = read and write and create permissions - ---------------------------------------------------------------------- ---- *** INHERITED RIGHTS FOR DIFFERENT INSTANCES AND RECIPIENTS *** ---- INSTANCE RECIPIENT PERMISSION(S) (COMMENT #INSTANCE) ---------------------------------------------------------------------- ---- 1 ROLE_SUPERVISOR Administer ---- 2 ROLE_SUPERVISOR None (overrides parent #1) ---- marissa Read ---- 3 ROLE_SUPERVISOR Administer (from parent #1) ---- scott Read, Write, Create ---- 4 ROLE_SUPERVISOR Administer (from parent #1) ---- 5 ROLE_SUPERVISOR Administer (from parent #3) ---- scott Read, Write, Create (from parent #3) ---- 6 ROLE_SUPERVISOR Administer (from parent #3) ---- scott Administer (overrides parent #3) - - So the above explains how a domain object instance has its - AclObjectIdentity discovered, and the - BasicAclDao will be polled successively until an - array of inherited permissions is constructed for the domain object - instance. The final step is to determine the - BasicAclEntry[]s that are actually applicable to a - given Authentication object. - - As you would recall, the AclManager (and all - delegates, up to and including BasicAclProvider) - provides a method which returns only those - BasicAclEntry[]s applying to a passed - Authentication object. - BasicAclProvider delivers this functionality by - delegating the filtering operation to an - EffectiveAclsResolver implementation. The default - implementation, - GrantedAuthorityEffectiveAclsResolver, will iterate - through the BasicAclEntry[]s and include only those - where the recipient is equal to either the - Authentication's principal or - any of the Authentication's - GrantedAuthority[]s. Please refer to the JavaDocs - for more information. - - - - Conclusion - - Acegi Security's instance-specific ACL packages shield you from - much of the complexity of developing your own ACL approach. The - interfaces and classes detailed above provide a scalable, customisable - ACL solution that is decoupled from your application code. Whilst the - reference documentation may suggest complexity, the basic - implementation is able to support most typical applications - out-of-the-box. - - - - - Filters - - - Overview - - The Acegi Security System for Spring uses filters extensively. - Each filter is covered in detail in a respective section of this - document. This section includes information that applies to all - filters. - - - - FilterToBeanProxy - - Most filters are configured using the - FilterToBeanProxy. An example configuration from - web.xml follows: - - <filter> - <filter-name>Acegi HTTP Request Security Filter</filter-name> - <filter-class>net.sf.acegisecurity.util.FilterToBeanProxy</filter-class> - <init-param> - <param-name>targetClass</param-name> - <param-value>net.sf.acegisecurity.ClassThatImplementsFilter</param-value> - </init-param> -</filter> - - Notice that the filter in web.xml is actually - a FilterToBeanProxy, and not the filter that will - actually implements the logic of the filter. What - FilterToBeanProxy does is delegate the - Filter's methods through to a bean which is - obtained from the Spring application context. This enables the bean to - benefit from the Spring application context lifecycle support and - configuration flexibility. The bean must implement - javax.servlet.Filter. - - The FilterToBeanProxy only requires a single - initialization parameter, targetClass or - targetBean. The targetClass - parameter locates the first object in the application context of the - specified class, whilst targetBean locates the - object by bean name. Like standard Spring web applications, the - FilterToBeanProxy accesses the application context - via - WebApplicationContextUtils.getWebApplicationContext(ServletContext), - so you should configure a ContextLoaderListener in - web.xml. - - - - Filter Ordering - - The order that filters are defined in web.xml - is important. - - Irrespective of which filters you are actually using, the order - of the <filter-mapping>s should be as - follows: - - - - Acegi Channel Processing Filter - (ChannelProcessingFilter) - - - - Acegi Authentication Processing Filter - (AuthenticationProcessingFilter) - - - - Acegi CAS Processing Filter - (CasProcessingFilter) - - - - Acegi HTTP BASIC Authorization Filter - (BasicProcessingFilter) - - - - Acegi Security System for Spring Auto Integration Filter - (AutoIntegrationFilter) - - - - Acegi HTTP Request Security Filter - (SecurityEnforcementFilter) - - - - All of the above filters use - FilterToBeanProxy, which is discussed in the - previous section. - - If you're using SiteMesh, ensure the Acegi Security filters - execute before the SiteMesh filters are called. This enables the - ContextHolder to be populated in time for use by - SiteMesh decorators. - - - - - Contacts Sample Application - - Included with the Acegi Security System for Spring is a very - simple application that can demonstrate the basic security facilities - provided by the system (and confirm your Container Adapter is properly - configured if you're using one). - - The Contacts sample application includes two deployable versions: - contacts.war is configured with the HTTP Session - Authentication approach, and does not use Container Adapters. The - contacts-container-adapter.war is configured to use a - Container Adapter. If you're just wanting to see how the sample - application works, please use contacts.war as it does - not require special configuration of your container. - - If you are going to use the - contacts-container-adapter.war version, first - configure your container as described in the Container Adapters section - of this chapter. Do not modify acegisecurity.xml. It - contains a very basic in-memory authentication configuration that is - compatible with the sample application. - - To deploy, simply copy the relevant - contacts.war or - contacts-container-adapter.war file from the Acegi - Security System for Spring distribution into your container’s - webapps directory. - - After starting your container, check the application can load. - Visit http://localhost:8080/contacts (or whichever - URL is appropriate for your web container and the WAR you deployed). A - random contact should be displayed. Click "Refresh" several times and - you will see different contacts. The business method that provides this - random contact is not secured. - - Next, click "Debug". You will be prompted to authenticate, and a - series of usernames and passwords are suggested on that page. Simply - authenticate with any of these and view the resulting page. It should - contain a success message similar to the following: - -

- Context on ContextHolder is of type: - net.sf.acegisecurity.context.SecureContextImpl - - The Context implements SecureContext. - - Authentication object is of type: - net.sf.acegisecurity.adapters.PrincipalAcegiUserToken - - Authentication object as a String: - net.sf.acegisecurity.adapters.PrincipalAcegiUserToken@e9a7c2: - Username: marissa; Password: [PROTECTED]; Authenticated: true; Granted - Authorities: ROLE_TELLER, ROLE_SUPERVISOR - - Authentication object holds the following granted - authorities: - - ROLE_TELLER (getAuthority(): ROLE_TELLER) - - ROLE_SUPERVISOR (getAuthority(): ROLE_SUPERVISOR) - - SUCCESS! Your [container adapter|web filter] appears to be - properly configured! -
- - If you receive a different message, and deployed - contacts-container-adapter.war, check you have - properly configured your Container Adapter. Refer to the instructions - provided above. - - Once you successfully receive the above message, return to the - sample application's home page and click "Manage". You can then try out - the application. Notice that only the contacts belonging to the - currently logged on user are displayed, and only users with - ROLE_SUPERVISOR are granted access to delete their - contacts. Behind the scenes, the - MethodSecurityInterceptor is securing the business - objects. If you're using contacts.war, the - FilterSecurityInterceptor is also securing the HTTP - requests. If using contacts.war, be sure to try - visiting http://localhost:8080/contacts/secure/super, - which will demonstrate access being denied by the - SecurityEnforcementFilter. - - The Contacts sample application also include a - client directory. Inside you will find a small - application that queries the backend business objects using the Hessian - and Burlap protocols. This demonstrates how to use the Acegi Security - System for Spring for authentication with Spring remoting protocols. To - try this client, ensure your servlet container is still running the - Contacts sample application, and then execute client marissa - marissa koala. The command-line parameters respectively - represent the owner of the contacts to extract, the username to use, and - the password to use. Note that you may need to edit - client.properties to use a different target URL. To - see that security does indeed work, try running client scott - marissa koala, which will try to obtain - scott's contacts when authenticating as - marissa. To see it work properly, use client - scott scott wombat. - - Please note the sample application's client - does not currently support CAS. You can still give it a try, though, if - you're ambitious: try client scott _cas_stateless_ - YOUR-SERVICE-TICKET-ID-FOR-SCOTT. - - - - Become Involved - - We welcome you to become involved in the Acegi Security System for - Spring project. There are many ways of contributing, including reading - the mailing list and responding to questions from other people, writing - new code, improving existing code, assisting with documentation, or - simply making suggestions. - - SourceForge provides CVS services for the project, allowing - anybody to access the latest code. If you wish to contribute new code, - please observe the following requirements. These exist to maintain the - quality and consistency of the project: - - - - Run the Ant format task (or use a suitable - IDE plug-in) to convert your code into the project's consistent - style - - - - Ensure your code does not break any unit tests (run the Ant - tests target) - - - - Please use the container integration test system to test your - code in the project's officially supported containers - - - - When writing a new container adapter, expand the container - integration test system to properly test it - - - - If you have added new code, please provide suitable unit tests - (use ant clover.html to view coverage) - - - - Join the acegisecurity-developer and acegisecurity-cvs mailing - lists so you're in the loop - - - - Use CamelCase - - - - Add a CVS $Id: index.xml,v 1.3 2004/04/02 21:12:25 - fbos Exp $ tag to the JavaDocs for any new class you - create - - - - Mentioned above is our container integration test system, which - aims to test the Acegi Security System for Spring container adapters - with current, production versions of each container. Some containers - might not be supported due to difficulties with starting or stopping the - container within an Ant target. You will need to download the container - release files as specified in the integration test - readme.txt file. These files are intentionally - excluded from CVS due to their large size. - - - - Further Information - - Questions and comments on the Acegi Security System for Spring are - welcome. Please use the Spring Community Forum web site at - http://forum.springframework.org. You're also welcome - to join the acegisecurity-developer mailing list. Our project home page - (where you can obtain the latest release of the project and access to - CVS, mailing lists, forums etc) is at - http://acegisecurity.sourceforge.net. - - - \ No newline at end of file diff --git a/docs/reference/styles/fopdf.xsl b/docs/reference/styles/fopdf.xsl deleted file mode 100644 index 2d23cc4f2c..0000000000 --- a/docs/reference/styles/fopdf.xsl +++ /dev/null @@ -1,488 +0,0 @@ - - - - - - -]> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Copyright (c) 2004 - - - - , - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -5em - -5em - - - - - - - - - - - - - - - Acegi Security System for Spring - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - bold - - - - - - - - - - - - - - - - - - - - - - - - - - - 1 - 0 - 1 - - 1 - - - - - - book toc - - - - 2 - - - - - - - - - - 0 - 0 - 0 - - - 5mm - 10mm - 10mm - - 15mm - 10mm - 0mm - - 18mm - 18mm - - - 0pc - - - - - left - false - - - 11 - 8 - - - 1.4 - - - - - - - 0.8em - - - - - - 17.4cm - - - - 4pt - 4pt - 4pt - 4pt - - - - 0.1pt - 0.1pt - - - - - 1 - - - - - - - - left - bold - - - pt - - - - - - - - - - - - - - - 0.8em - 0.8em - 0.8em - - - pt - - 0.1em - 0.1em - 0.1em - - - 0.6em - 0.6em - 0.6em - - - pt - - 0.1em - 0.1em - 0.1em - - - 0.4em - 0.4em - 0.4em - - - pt - - 0.1em - 0.1em - 0.1em - - - - - bold - - - pt - - false - 0.4em - 0.6em - 0.8em - - - - - - - - - pt - - - - - 1em - 1em - 1em - - - #444444 - solid - 0.1pt - 0.5em - 0.5em - 0.5em - 0.5em - 0.5em - 0.5em - - - - 1 - - #F0F0F0 - - - - - - 0 - 1 - - - 90 - - - - - '1' - &admon_gfx_path; - - - - - - figure after - example before - equation before - table before - procedure before - - - - 1 - - - - 0.8em - 0.8em - 0.8em - 0.1em - 0.1em - 0.1em - - - diff --git a/docs/reference/styles/html.css b/docs/reference/styles/html.css deleted file mode 100644 index 0a140789a4..0000000000 --- a/docs/reference/styles/html.css +++ /dev/null @@ -1,168 +0,0 @@ -A { - color: #003399; -} - -A:active { - color: #003399; -} - -A:visited { - color: #888888; -} - -P, DL, DT, DD, BLOCKQUOTE { - color: #000000; - margin-bottom: 3px; - margin-top: 3px; - padding-top: 0px; - /*border: 1px solid black;*/ -} - -OL, UL, P { - margin-top: 6px; - margin-bottom: 6px; -} - -P, BLOCKQUOTE { - font-size: 90%; -} - -P.releaseinfo { - font-size: 120%; font-weight: bold; - font-family: Arial, helvetica, sans-serif; - padding-top: 10px; -} - -P.pubdate { - font-size: 120%; font-weight: bold; - font-family: Arial, helvetica, sans-serif; -} - -td { - font-size: 80%; -} - - -TD, TH, SPAN { - color: #000000; -} - -BLOCKQUOTE { - margin-right: 0px; -} - -H1, H2, H3, H4, H5, H6 { - color: #000000; - font-weight:500; - margin-top:0px; - padding-top:14px; - font-family: Arial, helvetica, sans-serif; - margin-bottom: 0px; -} - -H2.title { - font-weight:800; - margin-bottom: 8px; -} - -H2.subtitle { - font-weight:800; - margin-bottom: 20px; -} - -H3.author { - color: #000000; - font-weight:500; - margin-top:0px; - padding-top:0px; - font-family: Arial, helvetica, sans-serif; - margin-bottom: 0px; -} - -TABLE { - border-collapse: collapse; - border-spacing:0; - border: 1px thin black; - empty-cells: hide; -} - -TD { - padding: 4pt; -} - -H1 { - font-size: 150%; -} -H2 { - font-size: 110%; -} -H3 { - font-size: 100%; font-weight: bold; -} -H4 { - font-size: 90%; font-weight: bold; -} -H5 { - font-size: 90%; font-style: italic; -} -H6 { - font-size: 100%; font-style: italic; -} - -TT { - font-size: 90%; - font-family: "Courier New", Courier, monospace; - color: #000000; -} - -.navheader, .navfooter { - background-color: #e4eff3; -} - -PRE { - font-size: 90%; - padding: 5px; - border-style: solid; - border-width: 1px; - border-color: #CCCCCC; - background-color: #F4F4F4; -} - -UL, OL, LI { - list-style: disc; -} - -HR { - width: 100%; - height: 1px; - background-color: #CCCCCC; - border-width: 0px; - padding: 0px; - color: #CCCCCC; -} - -.variablelist { - padding-top: 10; - padding-bottom:10; - margin:0; -} - -/*(.itemizedlist, UL { - padding-top: 0; - padding-bottom:0; - margin:0; -}*/ - -.term { - font-weight:bold; -} - -.mediaobject { - padding-top: 30px; - padding-bottom: 30px; -} - -.legalnotice { - font-size: 70%; -} - diff --git a/docs/reference/styles/html.xsl b/docs/reference/styles/html.xsl deleted file mode 100644 index 247cadcaee..0000000000 --- a/docs/reference/styles/html.xsl +++ /dev/null @@ -1,94 +0,0 @@ - - - - - - - -]> - - - - - - - - ../styles/html.css - - - 1 - 0 - 1 - 0 - - - - - - book toc - - - - 3 - - - - - 1 - - - - - - - 1 - &callout_gfx_path; - - - 90 - - - - - '1' - &admon_gfx_path; - - - - - - figure after - example before - equation before - table before - procedure before - - - diff --git a/docs/reference/styles/html_chunk.xsl b/docs/reference/styles/html_chunk.xsl deleted file mode 100644 index c6f12b557e..0000000000 --- a/docs/reference/styles/html_chunk.xsl +++ /dev/null @@ -1,96 +0,0 @@ - - - - - - - -]> - - - - - - - - '5' - '1' - ../styles/html.css - - - 1 - 0 - 1 - 0 - - - - - - book toc - - - - 3 - - - - - 1 - - - - - - - 1 - &callout_gfx_path; - - - 90 - - - - - '1' - &admon_gfx_path; - - - - - - figure after - example before - equation before - table before - procedure before - - -