From 691870c11dc113038f742665a16fef39eecc8d01 Mon Sep 17 00:00:00 2001
From: Alan Crosswell <alan@columbia.edu>
Date: Tue, 25 Jan 2022 10:00:18 -0500
Subject: [PATCH 01/20] Hash application client secrets using Django password
 hashing (#1093)

* Add ClientSecretField field to use Django password hashing algorithms (#1020)

Co-authored-by: Andrew Chen Wang <60190294+Andrew-Chen-Wang@users.noreply.github.com>
Co-authored-by: Peter Karman <pkarman@users.noreply.github.com>
Co-authored-by: Andrew Chen Wang <60190294+Andrew-Chen-Wang@users.noreply.github.com>
---
 AUTHORS                                       |  1 +
 CHANGELOG.md                                  | 12 +++++
 docs/settings.rst                             | 20 ++++----
 .../0006_alter_application_client_secret.py   | 31 ++++++++++++
 oauth2_provider/models.py                     | 23 ++++++++-
 oauth2_provider/oauth2_validators.py          |  5 +-
 tests/conftest.py                             |  6 ++-
 tests/test_authorization_code.py              | 48 ++++++++++---------
 tests/test_client_credential.py               | 38 +++++++--------
 tests/test_commands.py                        |  3 +-
 tests/test_hybrid.py                          | 31 ++++++------
 tests/test_introspection_view.py              | 13 ++---
 tests/test_oauth2_validators.py               | 24 +++++-----
 tests/test_password.py                        |  9 ++--
 tests/test_scopes.py                          | 15 +++---
 tests/test_token_revocation.py                | 15 +++---
 16 files changed, 185 insertions(+), 109 deletions(-)
 create mode 100644 oauth2_provider/migrations/0006_alter_application_client_secret.py

diff --git a/AUTHORS b/AUTHORS
index a1591b6da..c6e66453d 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -64,6 +64,7 @@ Jadiel Teófilo
 pySilver
 Łukasz Skarżyński
 Shaheed Haque
+Peter Karman
 Vinay Karanam
 Eduardo Oliveira
 Andrea Greco
diff --git a/CHANGELOG.md b/CHANGELOG.md
index b66e0822d..da07b6cab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -14,6 +14,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Security
   -->
 
+## [unreleased]
+
+## [2.0.0] unreleased
+
+### Changed
+* #1093 (**Breaking**) Changed to implement [hashed](https://docs.djangoproject.com/en/stable/topics/auth/passwords/)
+  client_secret values. This is a **breaking change** that will migrate all your existing
+  cleartext `application.client_secret` values to be hashed with Django's default password hashing algorithm
+  and can not be reversed. When adding or modifying an Application in the Admin console, you must copy the
+  auto-generated or manually-entered `client_secret` before hitting Save.
+
+
 ## [1.7.0] 2022-01-23
 
 ### Added
diff --git a/docs/settings.rst b/docs/settings.rst
index 01baaaf4b..0ba12df11 100644
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -97,19 +97,19 @@ of those three can be a callable) must be passed here directly and classes
 must be instantiated (callables should accept request as their only argument).
 
 GRANT_MODEL
-~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~
 The import string of the class (model) representing your grants. Overwrite
 this value if you wrote your own implementation (subclass of
 ``oauth2_provider.models.Grant``).
 
 APPLICATION_ADMIN_CLASS
-~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~
 The import string of the class (model) representing your application admin class.
 Overwrite this value if you wrote your own implementation (subclass of
 ``oauth2_provider.admin.ApplicationAdmin``).
 
 ACCESS_TOKEN_ADMIN_CLASS
-~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~
 The import string of the class (model) representing your access token admin class.
 Overwrite this value if you wrote your own implementation (subclass of
 ``oauth2_provider.admin.AccessTokenAdmin``).
@@ -121,7 +121,7 @@ Overwrite this value if you wrote your own implementation (subclass of
 ``oauth2_provider.admin.GrantAdmin``).
 
 REFRESH_TOKEN_ADMIN_CLASS
-~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~
 The import string of the class (model) representing your refresh token admin class.
 Overwrite this value if you wrote your own implementation (subclass of
 ``oauth2_provider.admin.RefreshTokenAdmin``).
@@ -154,7 +154,7 @@ If you don't change the validator code and don't run cleartokens all refresh
 tokens will last until revoked or the end of time. You should change this.
 
 REFRESH_TOKEN_GRACE_PERIOD_SECONDS
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 The number of seconds between when a refresh token is first used when it is
 expired. The most common case of this for this is native mobile applications
 that run into issues of network connectivity during the refresh cycle and are
@@ -178,7 +178,7 @@ See also: validator's rotate_refresh_token method can be overridden to make this
 when close to expiration, theoretically).
 
 REFRESH_TOKEN_GENERATOR
-~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~
 See `ACCESS_TOKEN_GENERATOR`. This is the same but for refresh tokens.
 Defaults to access token generator if not provided.
 
@@ -265,7 +265,7 @@ Default: ``""``
 The RSA private key used to sign OIDC ID tokens. If not set, OIDC is disabled.
 
 OIDC_RSA_PRIVATE_KEYS_INACTIVE
-~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Default: ``[]``
 
 An array of *inactive* RSA private keys. These keys are not used to sign tokens,
@@ -276,7 +276,7 @@ This is useful for providing a smooth transition during key rotation.
 should be retained in this inactive list.
 
 OIDC_JWKS_MAX_AGE_SECONDS
-~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~
 Default: ``3600``
 
 The max-age value for the Cache-Control header on jwks_uri.
@@ -354,9 +354,9 @@ load when clearing large batches of expired tokens.
 
 
 Settings imported from Django project
---------------------------
+-------------------------------------
 
 USE_TZ
-~~~~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~
 
 Used to determine whether or not to make token expire dates timezone aware.
diff --git a/oauth2_provider/migrations/0006_alter_application_client_secret.py b/oauth2_provider/migrations/0006_alter_application_client_secret.py
new file mode 100644
index 000000000..88e148274
--- /dev/null
+++ b/oauth2_provider/migrations/0006_alter_application_client_secret.py
@@ -0,0 +1,31 @@
+from django.db import migrations
+from django.contrib.auth.hashers import identify_hasher, make_password
+import logging
+import oauth2_provider.generators
+import oauth2_provider.models
+
+
+def forwards_func(apps, schema_editor):
+    """
+    Forward migration touches every application.client_secret which will cause it to be hashed if not already the case.
+    """
+    Application = apps.get_model('oauth2_provider', 'application')
+    applications = Application.objects.all()
+    for application in applications:
+        application.save(update_fields=['client_secret'])
+
+
+class Migration(migrations.Migration):
+
+    dependencies = [
+        ('oauth2_provider', '0005_auto_20211222_2352'),
+    ]
+
+    operations = [
+        migrations.AlterField(
+            model_name='application',
+            name='client_secret',
+            field=oauth2_provider.models.ClientSecretField(blank=True, db_index=True, default=oauth2_provider.generators.generate_client_secret, help_text='Hashed on Save. Copy it now if this is a new secret.', max_length=255),
+        ),
+        migrations.RunPython(forwards_func),
+    ]
diff --git a/oauth2_provider/models.py b/oauth2_provider/models.py
index 2c9747ce8..1ded7a4e2 100644
--- a/oauth2_provider/models.py
+++ b/oauth2_provider/models.py
@@ -6,6 +6,7 @@
 
 from django.apps import apps
 from django.conf import settings
+from django.contrib.auth.hashers import identify_hasher, make_password
 from django.core.exceptions import ImproperlyConfigured
 from django.db import models, transaction
 from django.urls import reverse
@@ -24,6 +25,20 @@
 logger = logging.getLogger(__name__)
 
 
+class ClientSecretField(models.CharField):
+    def pre_save(self, model_instance, add):
+        secret = getattr(model_instance, self.attname)
+        try:
+            hasher = identify_hasher(secret)
+            logger.debug(f"{model_instance}: {self.attname} is already hashed with {hasher}.")
+        except ValueError:
+            logger.debug(f"{model_instance}: {self.attname} is not hashed; hashing it now.")
+            hashed_secret = make_password(secret)
+            setattr(model_instance, self.attname, hashed_secret)
+            return hashed_secret
+        return super().pre_save(model_instance, add)
+
+
 class AbstractApplication(models.Model):
     """
     An Application instance represents a Client on the Authorization server.
@@ -90,8 +105,12 @@ class AbstractApplication(models.Model):
     )
     client_type = models.CharField(max_length=32, choices=CLIENT_TYPES)
     authorization_grant_type = models.CharField(max_length=32, choices=GRANT_TYPES)
-    client_secret = models.CharField(
-        max_length=255, blank=True, default=generate_client_secret, db_index=True
+    client_secret = ClientSecretField(
+        max_length=255,
+        blank=True,
+        default=generate_client_secret,
+        db_index=True,
+        help_text=_("Hashed on Save. Copy it now if this is a new secret."),
     )
     name = models.CharField(max_length=255, blank=True)
     skip_authorization = models.BooleanField(default=False)
diff --git a/oauth2_provider/oauth2_validators.py b/oauth2_provider/oauth2_validators.py
index 4d9480be1..00c5e7de0 100644
--- a/oauth2_provider/oauth2_validators.py
+++ b/oauth2_provider/oauth2_validators.py
@@ -12,6 +12,7 @@
 import requests
 from django.conf import settings
 from django.contrib.auth import authenticate, get_user_model
+from django.contrib.auth.hashers import check_password
 from django.core.exceptions import ObjectDoesNotExist
 from django.db import transaction
 from django.db.models import Q
@@ -123,7 +124,7 @@ def _authenticate_basic_auth(self, request):
         elif request.client.client_id != client_id:
             log.debug("Failed basic auth: wrong client id %s" % client_id)
             return False
-        elif request.client.client_secret != client_secret:
+        elif not check_password(client_secret, request.client.client_secret):
             log.debug("Failed basic auth: wrong client secret %s" % client_secret)
             return False
         else:
@@ -148,7 +149,7 @@ def _authenticate_request_body(self, request):
         if self._load_application(client_id, request) is None:
             log.debug("Failed body auth: Application %s does not exists" % client_id)
             return False
-        elif request.client.client_secret != client_secret:
+        elif not check_password(client_secret, request.client.client_secret):
             log.debug("Failed body auth: wrong client secret %s" % client_secret)
             return False
         else:
diff --git a/tests/conftest.py b/tests/conftest.py
index a3274aa33..520b6cbac 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -16,6 +16,8 @@
 Application = get_application_model()
 UserModel = get_user_model()
 
+CLEARTEXT_SECRET = "1234567890abcdefghijklmnopqrstuvwxyz"
+
 
 class OAuthSettingsWrapper:
     """
@@ -101,12 +103,14 @@ def application():
         client_type=Application.CLIENT_CONFIDENTIAL,
         authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
         algorithm=Application.RS256_ALGORITHM,
+        client_secret=CLEARTEXT_SECRET,
     )
 
 
 @pytest.fixture
 def hybrid_application(application):
     application.authorization_grant_type = application.GRANT_OPENID_HYBRID
+    application.client_secret = CLEARTEXT_SECRET
     application.save()
     return application
 
@@ -141,7 +145,7 @@ def oidc_tokens(oauth2_settings, application, test_user, client):
             "code": code,
             "redirect_uri": "http://example.org",
             "client_id": application.client_id,
-            "client_secret": application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
             "scope": "openid",
         },
     )
diff --git a/tests/test_authorization_code.py b/tests/test_authorization_code.py
index c9bef0f5c..91fd06bd1 100644
--- a/tests/test_authorization_code.py
+++ b/tests/test_authorization_code.py
@@ -34,6 +34,7 @@
 
 URI_OOB = "urn:ietf:wg:oauth:2.0:oob"
 URI_OOB_AUTO = "urn:ietf:wg:oauth:2.0:oob:auto"
+CLEARTEXT_SECRET = "1234567890abcdefghijklmnopqrstuvwxyz"
 
 
 # mocking a protected resource view
@@ -60,6 +61,7 @@ def setUp(self):
             user=self.dev_user,
             client_type=Application.CLIENT_CONFIDENTIAL,
             authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
+            client_secret=CLEARTEXT_SECRET,
         )
 
     def tearDown(self):
@@ -677,7 +679,7 @@ def test_basic_auth(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
@@ -699,7 +701,7 @@ def test_refresh(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -744,7 +746,7 @@ def test_refresh_with_grace_period(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -795,7 +797,7 @@ def test_refresh_invalidates_old_tokens(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -827,7 +829,7 @@ def test_refresh_no_scopes(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -855,7 +857,7 @@ def test_refresh_bad_scopes(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -881,7 +883,7 @@ def test_refresh_fail_repeating_requests(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -911,7 +913,7 @@ def test_refresh_repeating_requests(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -948,7 +950,7 @@ def test_refresh_repeating_requests_non_rotating_tokens(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -977,7 +979,7 @@ def test_basic_auth_bad_authcode(self):
             "code": "BLAH",
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 400)
@@ -989,7 +991,7 @@ def test_basic_auth_bad_granttype(self):
         self.client.login(username="test_user", password="123456")
 
         token_request_data = {"grant_type": "UNKNOWN", "code": "BLAH", "redirect_uri": "http://example.org"}
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 400)
@@ -1014,7 +1016,7 @@ def test_basic_auth_grant_expired(self):
             "code": "BLAH",
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 400)
@@ -1049,7 +1051,7 @@ def test_basic_auth_wrong_auth_type(self):
             "redirect_uri": "http://example.org",
         }
 
-        user_pass = "{0}:{1}".format(self.application.client_id, self.application.client_secret)
+        user_pass = "{0}:{1}".format(self.application.client_id, CLEARTEXT_SECRET)
         auth_string = base64.b64encode(user_pass.encode("utf-8"))
         auth_headers = {
             "HTTP_AUTHORIZATION": "Wrong " + auth_string.decode("utf-8"),
@@ -1070,7 +1072,7 @@ def test_request_body_params(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
             "client_id": self.application.client_id,
-            "client_secret": self.application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
         }
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data)
@@ -1445,7 +1447,7 @@ def test_code_exchange_succeed_when_redirect_uri_match(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org?foo=bar",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
@@ -1480,7 +1482,7 @@ def test_code_exchange_fails_when_redirect_uri_does_not_match(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org?foo=baraa",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 400)
@@ -1520,7 +1522,7 @@ def test_code_exchange_succeed_when_redirect_uri_match_with_multiple_query_param
             "code": authorization_code,
             "redirect_uri": "http://example.com?bar=baz&foo=bar",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
@@ -1565,7 +1567,7 @@ def test_oob_as_html(self):
             "code": authorization_code,
             "redirect_uri": URI_OOB,
             "client_id": self.application.client_id,
-            "client_secret": self.application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
         }
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data)
@@ -1605,7 +1607,7 @@ def test_oob_as_json(self):
             "code": authorization_code,
             "redirect_uri": URI_OOB_AUTO,
             "client_id": self.application.client_id,
-            "client_secret": self.application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
         }
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data)
@@ -1681,7 +1683,7 @@ def test_id_token_code_exchange_succeed_when_redirect_uri_match_with_multiple_qu
             "code": authorization_code,
             "redirect_uri": "http://example.com?bar=baz&foo=bar",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
@@ -1715,7 +1717,7 @@ def test_id_token(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
             "client_id": self.application.client_id,
-            "client_secret": self.application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
             "scope": "openid",
         }
 
@@ -1761,7 +1763,7 @@ def test_resource_access_allowed(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -1819,7 +1821,7 @@ def test_id_token_resource_access_allowed(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
diff --git a/tests/test_client_credential.py b/tests/test_client_credential.py
index 8159d55db..38265c3d9 100644
--- a/tests/test_client_credential.py
+++ b/tests/test_client_credential.py
@@ -1,6 +1,5 @@
 import json
 from unittest.mock import patch
-from urllib.parse import quote_plus
 
 import pytest
 from django.contrib.auth import get_user_model
@@ -24,6 +23,8 @@
 AccessToken = get_access_token_model()
 UserModel = get_user_model()
 
+CLEARTEXT_SECRET = "abcdefghijklmnopqrstuvwxyz1234567890"
+
 
 # mocking a protected resource view
 class ResourceView(ProtectedResourceView):
@@ -44,6 +45,7 @@ def setUp(self):
             user=self.dev_user,
             client_type=Application.CLIENT_PUBLIC,
             authorization_grant_type=Application.GRANT_CLIENT_CREDENTIALS,
+            client_secret=CLEARTEXT_SECRET,
         )
 
     def tearDown(self):
@@ -55,35 +57,28 @@ def tearDown(self):
 class TestClientCredential(BaseTest):
     def test_client_credential_access_allowed(self):
         """
-        Request an access token using Client Credential Flow
+        Request an access token using Client Credential Flow with hashed secrets
         """
+        self.assertNotEqual(self.application.client_secret, CLEARTEXT_SECRET)
+
         token_request_data = {
             "grant_type": "client_credentials",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
 
-        content = json.loads(response.content.decode("utf-8"))
-        access_token = content["access_token"]
-
-        # use token to access the resource
-        auth_headers = {
-            "HTTP_AUTHORIZATION": "Bearer " + access_token,
-        }
-        request = self.factory.get("/fake-resource", **auth_headers)
-        request.user = self.test_user
-
-        view = ResourceView.as_view()
-        response = view(request)
-        self.assertEqual(response, "This is a protected resource")
+        # secret mismatch should return a 401
+        auth_headers = get_basic_auth_header(self.application.client_id, "not-the-secret")
+        response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
+        self.assertEqual(response.status_code, 401)
 
     def test_client_credential_does_not_issue_refresh_token(self):
         token_request_data = {
             "grant_type": "client_credentials",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
@@ -93,7 +88,7 @@ def test_client_credential_does_not_issue_refresh_token(self):
 
     def test_client_credential_user_is_none_on_access_token(self):
         token_request_data = {"grant_type": "client_credentials"}
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
@@ -122,7 +117,7 @@ def test_extended_request(self):
         token_request_data = {
             "grant_type": "client_credentials",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
 
@@ -174,12 +169,11 @@ def test_client_resource_password_based(self):
             user=self.dev_user,
             client_type=Application.CLIENT_CONFIDENTIAL,
             authorization_grant_type=Application.GRANT_PASSWORD,
+            client_secret=CLEARTEXT_SECRET,
         )
 
         token_request_data = {"grant_type": "password", "username": "test_user", "password": "123456"}
-        auth_headers = get_basic_auth_header(
-            quote_plus(self.application.client_id), quote_plus(self.application.client_secret)
-        )
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
diff --git a/tests/test_commands.py b/tests/test_commands.py
index ff5deba4e..13b0eeb3d 100644
--- a/tests/test_commands.py
+++ b/tests/test_commands.py
@@ -1,6 +1,7 @@
 from io import StringIO
 
 from django.contrib.auth import get_user_model
+from django.contrib.auth.hashers import check_password
 from django.core.management import call_command
 from django.core.management.base import CommandError
 from django.test import TestCase
@@ -83,7 +84,7 @@ def test_application_created_with_client_secret(self):
         )
         app = Application.objects.get()
 
-        self.assertEqual(app.client_secret, "SECRET")
+        self.assertTrue(check_password("SECRET", app.client_secret))
 
     def test_application_created_with_client_id(self):
         call_command(
diff --git a/tests/test_hybrid.py b/tests/test_hybrid.py
index 4f9753979..3f4048698 100644
--- a/tests/test_hybrid.py
+++ b/tests/test_hybrid.py
@@ -30,6 +30,8 @@
 RefreshToken = get_refresh_token_model()
 UserModel = get_user_model()
 
+CLEARTEXT_SECRET = "1234567890abcdefghijklmnopqrstuvwxyz"
+
 
 # mocking a protected resource view
 class ResourceView(ProtectedResourceView):
@@ -62,6 +64,7 @@ def setUp(self):
             client_type=Application.CLIENT_CONFIDENTIAL,
             authorization_grant_type=Application.GRANT_OPENID_HYBRID,
             algorithm=Application.RS256_ALGORITHM,
+            client_secret=CLEARTEXT_SECRET,
         )
         self.application.save()
 
@@ -829,7 +832,7 @@ def test_basic_auth(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
@@ -850,7 +853,7 @@ def test_basic_auth_bad_authcode(self):
             "code": "BLAH",
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 400)
@@ -862,7 +865,7 @@ def test_basic_auth_bad_granttype(self):
         self.client.login(username="hy_test_user", password="123456")
 
         token_request_data = {"grant_type": "UNKNOWN", "code": "BLAH", "redirect_uri": "http://example.org"}
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 400)
@@ -887,7 +890,7 @@ def test_basic_auth_grant_expired(self):
             "code": "BLAH",
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 400)
@@ -922,7 +925,7 @@ def test_basic_auth_wrong_auth_type(self):
             "redirect_uri": "http://example.org",
         }
 
-        user_pass = "{0}:{1}".format(self.application.client_id, self.application.client_secret)
+        user_pass = "{0}:{1}".format(self.application.client_id, CLEARTEXT_SECRET)
         auth_string = base64.b64encode(user_pass.encode("utf-8"))
         auth_headers = {
             "HTTP_AUTHORIZATION": "Wrong " + auth_string.decode("utf-8"),
@@ -943,7 +946,7 @@ def test_request_body_params(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
             "client_id": self.application.client_id,
-            "client_secret": self.application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
         }
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data)
@@ -1056,7 +1059,7 @@ def test_code_exchange_succeed_when_redirect_uri_match(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org?foo=bar",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
@@ -1091,7 +1094,7 @@ def test_code_exchange_fails_when_redirect_uri_does_not_match(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org?foo=baraa",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 400)
@@ -1126,7 +1129,7 @@ def test_code_exchange_succeed_when_redirect_uri_match_with_multiple_query_param
             "code": authorization_code,
             "redirect_uri": "http://example.com?bar=baz&foo=bar",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
@@ -1163,7 +1166,7 @@ def test_id_token_code_exchange_succeed_when_redirect_uri_match_with_multiple_qu
             "code": authorization_code,
             "redirect_uri": "http://example.com?bar=baz&foo=bar",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
@@ -1200,7 +1203,7 @@ def test_resource_access_allowed(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -1239,7 +1242,7 @@ def test_id_token_resource_access_allowed(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -1351,7 +1354,7 @@ def test_id_token_nonce_in_token_response(oauth2_settings, test_user, hybrid_app
             "code": code,
             "redirect_uri": "http://example.org",
             "client_id": hybrid_application.client_id,
-            "client_secret": hybrid_application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
             "scope": "openid",
         },
     )
@@ -1422,7 +1425,7 @@ def test_claims_passed_to_code_generation(
             "code": code,
             "redirect_uri": "http://example.org",
             "client_id": hybrid_application.client_id,
-            "client_secret": hybrid_application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
             "scope": "openid",
         },
     )
diff --git a/tests/test_introspection_view.py b/tests/test_introspection_view.py
index 95374cda5..b19c521d5 100644
--- a/tests/test_introspection_view.py
+++ b/tests/test_introspection_view.py
@@ -17,6 +17,8 @@
 AccessToken = get_access_token_model()
 UserModel = get_user_model()
 
+CLEARTEXT_SECRET = "1234567890abcdefghijklmnopqrstuvwxyz"
+
 
 @pytest.mark.usefixtures("oauth2_settings")
 @pytest.mark.oauth2_settings(presets.INTROSPECTION_SETTINGS)
@@ -35,6 +37,7 @@ def setUp(self):
             user=self.test_user,
             client_type=Application.CLIENT_CONFIDENTIAL,
             authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
+            client_secret=CLEARTEXT_SECRET,
         )
 
         self.resource_server_token = AccessToken.objects.create(
@@ -281,7 +284,7 @@ def test_view_post_notexisting_token(self):
 
     def test_view_post_valid_client_creds_basic_auth(self):
         """Test HTTP basic auth working"""
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
         response = self.client.post(
             reverse("oauth2_provider:introspect"), {"token": self.valid_token.token}, **auth_headers
         )
@@ -301,9 +304,7 @@ def test_view_post_valid_client_creds_basic_auth(self):
 
     def test_view_post_invalid_client_creds_basic_auth(self):
         """Must fail for invalid client credentials"""
-        auth_headers = get_basic_auth_header(
-            self.application.client_id, self.application.client_secret + "_so_wrong"
-        )
+        auth_headers = get_basic_auth_header(self.application.client_id, f"{CLEARTEXT_SECRET}_so_wrong")
         response = self.client.post(
             reverse("oauth2_provider:introspect"), {"token": self.valid_token.token}, **auth_headers
         )
@@ -316,7 +317,7 @@ def test_view_post_valid_client_creds_plaintext(self):
             {
                 "token": self.valid_token.token,
                 "client_id": self.application.client_id,
-                "client_secret": self.application.client_secret,
+                "client_secret": CLEARTEXT_SECRET,
             },
         )
         self.assertEqual(response.status_code, 200)
@@ -340,7 +341,7 @@ def test_view_post_invalid_client_creds_plaintext(self):
             {
                 "token": self.valid_token.token,
                 "client_id": self.application.client_id,
-                "client_secret": self.application.client_secret + "_so_wrong",
+                "client_secret": f"{CLEARTEXT_SECRET}_so_wrong",
             },
         )
         self.assertEqual(response.status_code, 403)
diff --git a/tests/test_oauth2_validators.py b/tests/test_oauth2_validators.py
index 7997d3bca..fd06a1eda 100644
--- a/tests/test_oauth2_validators.py
+++ b/tests/test_oauth2_validators.py
@@ -15,6 +15,7 @@
 from oauth2_provider.oauth2_validators import OAuth2Validator
 
 from . import presets
+from .utils import get_basic_auth_header
 
 
 try:
@@ -28,6 +29,8 @@
 AccessToken = get_access_token_model()
 RefreshToken = get_refresh_token_model()
 
+CLEARTEXT_SECRET = "1234567890abcdefghijklmnopqrstuvwxyz"
+
 
 @contextlib.contextmanager
 def always_invalid_token():
@@ -51,7 +54,7 @@ def setUp(self):
         self.validator = OAuth2Validator()
         self.application = Application.objects.create(
             client_id="client_id",
-            client_secret="client_secret",
+            client_secret=CLEARTEXT_SECRET,
             user=self.user,
             client_type=Application.CLIENT_PUBLIC,
             authorization_grant_type=Application.GRANT_PASSWORD,
@@ -69,7 +72,7 @@ def test_authenticate_request_body(self):
         self.request.client_secret = "wrong_client_secret"
         self.assertFalse(self.validator._authenticate_request_body(self.request))
 
-        self.request.client_secret = "client_secret"
+        self.request.client_secret = CLEARTEXT_SECRET
         self.assertTrue(self.validator._authenticate_request_body(self.request))
 
     def test_extract_basic_auth(self):
@@ -86,26 +89,22 @@ def test_extract_basic_auth(self):
 
     def test_authenticate_basic_auth(self):
         self.request.encoding = "utf-8"
-        # client_id:client_secret
-        self.request.headers = {"HTTP_AUTHORIZATION": "Basic Y2xpZW50X2lkOmNsaWVudF9zZWNyZXQ=\n"}
+        self.request.headers = get_basic_auth_header("client_id", CLEARTEXT_SECRET)
         self.assertTrue(self.validator._authenticate_basic_auth(self.request))
 
     def test_authenticate_basic_auth_default_encoding(self):
         self.request.encoding = None
-        # client_id:client_secret
-        self.request.headers = {"HTTP_AUTHORIZATION": "Basic Y2xpZW50X2lkOmNsaWVudF9zZWNyZXQ=\n"}
+        self.request.headers = get_basic_auth_header("client_id", CLEARTEXT_SECRET)
         self.assertTrue(self.validator._authenticate_basic_auth(self.request))
 
     def test_authenticate_basic_auth_wrong_client_id(self):
         self.request.encoding = "utf-8"
-        # wrong_id:client_secret
-        self.request.headers = {"HTTP_AUTHORIZATION": "Basic d3JvbmdfaWQ6Y2xpZW50X3NlY3JldA==\n"}
+        self.request.headers = get_basic_auth_header("wrong_id", CLEARTEXT_SECRET)
         self.assertFalse(self.validator._authenticate_basic_auth(self.request))
 
     def test_authenticate_basic_auth_wrong_client_secret(self):
         self.request.encoding = "utf-8"
-        # client_id:wrong_secret
-        self.request.headers = {"HTTP_AUTHORIZATION": "Basic Y2xpZW50X2lkOndyb25nX3NlY3JldA==\n"}
+        self.request.headers = get_basic_auth_header("client_id", "wrong_secret")
         self.assertFalse(self.validator._authenticate_basic_auth(self.request))
 
     def test_authenticate_basic_auth_not_b64_auth_string(self):
@@ -116,7 +115,6 @@ def test_authenticate_basic_auth_not_b64_auth_string(self):
 
     def test_authenticate_basic_auth_invalid_b64_string(self):
         self.request.encoding = "utf-8"
-        # client_id:wrong_secret
         self.request.headers = {"HTTP_AUTHORIZATION": "Basic ZHVtbXk=:ZHVtbXk=\n"}
         self.assertFalse(self.validator._authenticate_basic_auth(self.request))
 
@@ -140,7 +138,7 @@ def test_client_authentication_required(self):
         self.assertTrue(self.validator.client_authentication_required(self.request))
         self.request.headers = {}
         self.request.client_id = "client_id"
-        self.request.client_secret = "client_secret"
+        self.request.client_secret = CLEARTEXT_SECRET
         self.assertTrue(self.validator.client_authentication_required(self.request))
         self.request.client_secret = ""
         self.assertFalse(self.validator.client_authentication_required(self.request))
@@ -327,7 +325,7 @@ def setUp(self):
         self.validator = OAuth2Validator()
         self.application = Application.objects.create(
             client_id="client_id",
-            client_secret="client_secret",
+            client_secret=CLEARTEXT_SECRET,
             user=self.user,
             client_type=Application.CLIENT_PUBLIC,
             authorization_grant_type=Application.GRANT_PASSWORD,
diff --git a/tests/test_password.py b/tests/test_password.py
index 953b076e2..ab0f49228 100644
--- a/tests/test_password.py
+++ b/tests/test_password.py
@@ -14,6 +14,8 @@
 Application = get_application_model()
 UserModel = get_user_model()
 
+CLEARTEXT_SECRET = "1234567890abcdefghijklmnopqrstuvwxyz"
+
 
 # mocking a protected resource view
 class ResourceView(ProtectedResourceView):
@@ -33,6 +35,7 @@ def setUp(self):
             user=self.dev_user,
             client_type=Application.CLIENT_PUBLIC,
             authorization_grant_type=Application.GRANT_PASSWORD,
+            client_secret=CLEARTEXT_SECRET,
         )
 
     def tearDown(self):
@@ -51,7 +54,7 @@ def test_get_token(self):
             "username": "test_user",
             "password": "123456",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 200)
@@ -70,7 +73,7 @@ def test_bad_credentials(self):
             "username": "test_user",
             "password": "NOT_MY_PASS",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         self.assertEqual(response.status_code, 400)
@@ -83,7 +86,7 @@ def test_password_resource_access_allowed(self):
             "username": "test_user",
             "password": "123456",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
diff --git a/tests/test_scopes.py b/tests/test_scopes.py
index a310e223a..39601ed3b 100644
--- a/tests/test_scopes.py
+++ b/tests/test_scopes.py
@@ -18,6 +18,8 @@
 Grant = get_grant_model()
 UserModel = get_user_model()
 
+CLEARTEXT_SECRET = "1234567890abcdefghijklmnopqrstuvwxyz"
+
 
 # mocking a protected resource view
 class ScopeResourceView(ScopedProtectedResourceView):
@@ -67,6 +69,7 @@ def setUp(self):
             user=self.dev_user,
             client_type=Application.CLIENT_CONFIDENTIAL,
             authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
+            client_secret=CLEARTEXT_SECRET,
         )
 
     def tearDown(self):
@@ -123,7 +126,7 @@ def test_scopes_save_in_access_token(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -159,7 +162,7 @@ def test_scopes_protection_valid(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -201,7 +204,7 @@ def test_scopes_protection_fail(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -243,7 +246,7 @@ def test_multi_scope_fail(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -285,7 +288,7 @@ def test_multi_scope_valid(self):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
@@ -326,7 +329,7 @@ def get_access_token(self, scopes):
             "code": authorization_code,
             "redirect_uri": "http://example.org",
         }
-        auth_headers = get_basic_auth_header(self.application.client_id, self.application.client_secret)
+        auth_headers = get_basic_auth_header(self.application.client_id, CLEARTEXT_SECRET)
 
         response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data, **auth_headers)
         content = json.loads(response.content.decode("utf-8"))
diff --git a/tests/test_token_revocation.py b/tests/test_token_revocation.py
index 1ed1c9119..b4f5af7dd 100644
--- a/tests/test_token_revocation.py
+++ b/tests/test_token_revocation.py
@@ -13,6 +13,8 @@
 RefreshToken = get_refresh_token_model()
 UserModel = get_user_model()
 
+CLEARTEXT_SECRET = "1234567890abcdefghijklmnopqrstuvwxyz"
+
 
 class BaseTest(TestCase):
     def setUp(self):
@@ -26,6 +28,7 @@ def setUp(self):
             user=self.dev_user,
             client_type=Application.CLIENT_CONFIDENTIAL,
             authorization_grant_type=Application.GRANT_AUTHORIZATION_CODE,
+            client_secret=CLEARTEXT_SECRET,
         )
 
     def tearDown(self):
@@ -46,7 +49,7 @@ def test_revoke_access_token(self):
 
         data = {
             "client_id": self.application.client_id,
-            "client_secret": self.application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
             "token": tok.token,
         }
         url = reverse("oauth2_provider:revoke-token")
@@ -93,7 +96,7 @@ def test_revoke_access_token_with_hint(self):
 
         data = {
             "client_id": self.application.client_id,
-            "client_secret": self.application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
             "token": tok.token,
             "token_type_hint": "access_token",
         }
@@ -115,7 +118,7 @@ def test_revoke_access_token_with_invalid_hint(self):
 
         data = {
             "client_id": self.application.client_id,
-            "client_secret": self.application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
             "token": tok.token,
             "token_type_hint": "bad_hint",
         }
@@ -139,7 +142,7 @@ def test_revoke_refresh_token(self):
 
         data = {
             "client_id": self.application.client_id,
-            "client_secret": self.application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
             "token": rtok.token,
         }
 
@@ -164,7 +167,7 @@ def test_revoke_refresh_token_with_revoked_access_token(self):
         for token in (tok.token, rtok.token):
             data = {
                 "client_id": self.application.client_id,
-                "client_secret": self.application.client_secret,
+                "client_secret": CLEARTEXT_SECRET,
                 "token": token,
             }
 
@@ -194,7 +197,7 @@ def test_revoke_token_with_wrong_hint(self):
 
         data = {
             "client_id": self.application.client_id,
-            "client_secret": self.application.client_secret,
+            "client_secret": CLEARTEXT_SECRET,
             "token": tok.token,
             "token_type_hint": "refresh_token",
         }

From f46439e69844feb12fc8e5a6dcb99dd569abec3f Mon Sep 17 00:00:00 2001
From: Alan Crosswell <alan@columbia.edu>
Date: Thu, 27 Jan 2022 12:23:16 -0500
Subject: [PATCH 02/20] OIDC: Add "scopes_supported" to openid-configuration.
 (#1106)

* OIDC: Add "scopes_supported" to openid-configuration.
---
 CHANGELOG.md                  | 4 ++++
 oauth2_provider/views/oidc.py | 7 ++++++-
 tests/test_oidc_views.py      | 2 ++
 3 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index da07b6cab..6a18b1bd2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -18,6 +18,10 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [2.0.0] unreleased
 
+### Added
+* #1106 Add "scopes_supported" to the [ConnectDiscoveryInfoView](https://django-oauth-toolkit.readthedocs.io/en/latest/oidc.html#connectdiscoveryinfoview).
+  This completes the view to provide all the REQUIRED and RECOMMENDED [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
+
 ### Changed
 * #1093 (**Breaking**) Changed to implement [hashed](https://docs.djangoproject.com/en/stable/topics/auth/passwords/)
   client_secret values. This is a **breaking change** that will migrate all your existing
diff --git a/oauth2_provider/views/oidc.py b/oauth2_provider/views/oidc.py
index e66b30a86..bb47d4f43 100644
--- a/oauth2_provider/views/oidc.py
+++ b/oauth2_provider/views/oidc.py
@@ -18,7 +18,8 @@
 
 class ConnectDiscoveryInfoView(OIDCOnlyMixin, View):
     """
-    View used to show oidc provider configuration information
+    View used to show oidc provider configuration information per
+    `OpenID Provider Metadata <https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata>`_
     """
 
     def get(self, request, *args, **kwargs):
@@ -49,6 +50,9 @@ def get(self, request, *args, **kwargs):
         validator_class = oauth2_settings.OAUTH2_VALIDATOR_CLASS
         validator = validator_class()
         oidc_claims = list(set(validator.get_discovery_claims(request)))
+        scopes_class = oauth2_settings.SCOPES_BACKEND_CLASS
+        scopes = scopes_class()
+        scopes_supported = [scope for scope in scopes.get_available_scopes()]
 
         data = {
             "issuer": issuer_url,
@@ -56,6 +60,7 @@ def get(self, request, *args, **kwargs):
             "token_endpoint": token_endpoint,
             "userinfo_endpoint": userinfo_endpoint,
             "jwks_uri": jwks_uri,
+            "scopes_supported": scopes_supported,
             "response_types_supported": oauth2_settings.OIDC_RESPONSE_TYPES_SUPPORTED,
             "subject_types_supported": oauth2_settings.OIDC_SUBJECT_TYPES_SUPPORTED,
             "id_token_signing_alg_values_supported": signing_algorithms,
diff --git a/tests/test_oidc_views.py b/tests/test_oidc_views.py
index fa514ac92..5eb9c2d77 100644
--- a/tests/test_oidc_views.py
+++ b/tests/test_oidc_views.py
@@ -17,6 +17,7 @@ def test_get_connect_discovery_info(self):
             "token_endpoint": "http://localhost/o/token/",
             "userinfo_endpoint": "http://localhost/o/userinfo/",
             "jwks_uri": "http://localhost/o/.well-known/jwks.json",
+            "scopes_supported": ["read", "write", "openid"],
             "response_types_supported": [
                 "code",
                 "token",
@@ -44,6 +45,7 @@ def test_get_connect_discovery_info_without_issuer_url(self):
             "token_endpoint": "http://testserver/o/token/",
             "userinfo_endpoint": "http://testserver/o/userinfo/",
             "jwks_uri": "http://testserver/o/.well-known/jwks.json",
+            "scopes_supported": ["read", "write", "openid"],
             "response_types_supported": [
                 "code",
                 "token",

From 492a867499b50f348c28db4ef3e429e8f46dc412 Mon Sep 17 00:00:00 2001
From: Alan Crosswell <alan@columbia.edu>
Date: Tue, 1 Feb 2022 09:17:19 -0500
Subject: [PATCH 03/20] OIDC: Standard scopes to determine which claims are
 returned (#1108)

* Add configurable attribute to restrict returned claims based on scopes.
---
 CHANGELOG.md                         |  8 ++-
 docs/oidc.rst                        | 94 +++++++++++++++++++---------
 oauth2_provider/oauth2_validators.py | 37 ++++++++++-
 tests/conftest.py                    | 40 ++++++++++++
 tests/presets.py                     |  2 +
 tests/test_oidc_views.py             | 56 +++++++++++++++++
 6 files changed, 203 insertions(+), 34 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 6a18b1bd2..23035d0b2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -19,7 +19,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ## [2.0.0] unreleased
 
 ### Added
-* #1106 Add "scopes_supported" to the [ConnectDiscoveryInfoView](https://django-oauth-toolkit.readthedocs.io/en/latest/oidc.html#connectdiscoveryinfoview).
+* #1106 OIDC: Add "scopes_supported" to the [ConnectDiscoveryInfoView](https://django-oauth-toolkit.readthedocs.io/en/latest/oidc.html#connectdiscoveryinfoview).
   This completes the view to provide all the REQUIRED and RECOMMENDED [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
 
 ### Changed
@@ -28,7 +28,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   cleartext `application.client_secret` values to be hashed with Django's default password hashing algorithm
   and can not be reversed. When adding or modifying an Application in the Admin console, you must copy the
   auto-generated or manually-entered `client_secret` before hitting Save.
+* #1108 OIDC: (**Breaking**) Add default configurable OIDC standard scopes that determine which claims are returned.
+  If you've [customized OIDC responses](https://django-oauth-toolkit.readthedocs.io/en/latest/oidc.html#customizing-the-oidc-responses)
+  and want to retain the pre-2.x behavior, set `oidc_claim_scope = None` in your subclass of `OAuth2Validator`.
+* #1108 OIDC: Make the `access_token` available to `get_oidc_claims` when called from `get_userinfo_claims`.
 
+### Fixed
+* #1108 OIDC: Fix `validate_bearer_token()` to properly set `request.scopes` to the list of granted scopes.
 
 ## [1.7.0] 2022-01-23
 
diff --git a/docs/oidc.rst b/docs/oidc.rst
index 143bec5e5..8dfea2e16 100644
--- a/docs/oidc.rst
+++ b/docs/oidc.rst
@@ -102,7 +102,7 @@ so there is no need to add a setting for the public key.
 
 
 Rotating the RSA private key
-~~~~~~~~~~~~~~~~~~~~~~~~
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Extra keys can be published in the jwks_uri with the ``OIDC_RSA_PRIVATE_KEYS_INACTIVE``
 setting. For example:::
 
@@ -143,7 +143,7 @@ scopes in your ``settings.py``::
         # ... any other settings you want
     }
 
-.. info::
+.. note::
     If you want to enable ``RS256`` at a later date, you can do so - just add
     the private key as described above.
 
@@ -250,54 +250,88 @@ our custom validator. It takes one of two forms:
 The first form gets passed a request object, and should return a dictionary
 mapping a claim name to claim data::
     class CustomOAuth2Validator(OAuth2Validator):
+	# Set `oidc_claim_scope = None` to ignore scopes that limit which claims to return,
+	# otherwise the OIDC standard scopes are used.
+
         def get_additional_claims(self, request):
-            claims = {}
-            claims["email"] = request.user.get_user_email()
-            claims["username"] = request.user.get_full_name()
+	    return {
+		"given_name": request.user.first_name,
+		"family_name": request.user.last_name,
+		"name": ' '.join([request.user.first_name, request.user.last_name]),
+		"preferred_username": request.user.username,
+		"email": request.user.email,
+	    }
 
-            return claims
 
 The second form gets no request object, and should return a dictionary
 mapping a claim name to a callable, accepting a request and producing
 the claim data::
     class CustomOAuth2Validator(OAuth2Validator):
-        def get_additional_claims(self):
-            def get_user_email(request):
-                return request.user.get_user_email()
+	# Extend the standard scopes to add a new "permissions" scope
+	# which returns a "permissions" claim:
+	oidc_claim_scope = OAuth2Validator.oidc_claim_scope
+	oidc_claim_scope.update({"permissions": "permissions"})
+
+	def get_additional_claims(self):
+	    return {
+		"given_name": lambda request: request.user.first_name,
+		"family_name": lambda request: request.user.last_name,
+		"name": lambda request: ' '.join([request.user.first_name, request.user.last_name]),
+		"preferred_username": lambda request: request.user.username,
+		"email": lambda request: request.user.email,
+		"permissions": lambda request: list(request.user.get_group_permissions()),
+	    }
 
-            claims = {}
-            claims["email"] = get_user_email
-            claims["username"] = lambda r: r.user.get_full_name()
-
-            return claims
 
 Standard claim ``sub`` is included by default, to remove it override ``get_claim_dict``.
 
-In some cases, it might be desirable to not list all claims in discovery info. To customize
-which claims are advertised, you can override the ``get_discovery_claims`` method to return
-a list of claim names to advertise. If your ``get_additional_claims`` uses the first form
-and you still want to advertise claims, you can also override ``get_discovery_claims``.
+Supported claims discovery
+--------------------------
 
-In order to help lcients discover claims early, they can be advertised in the discovery
+In order to help clients discover claims early, they can be advertised in the discovery
 info, under the ``claims_supported`` key. In order for the discovery info view to automatically
 add all claims your validator returns, you need to use the second form (producing callables),
 because the discovery info views are requested with an unauthenticated request, so directly
 producing claim data would fail. If you use the first form, producing claim data directly,
 your claims will not be added to discovery info.
 
+In some cases, it might be desirable to not list all claims in discovery info. To customize
+which claims are advertised, you can override the ``get_discovery_claims`` method to return
+a list of claim names to advertise. If your ``get_additional_claims`` uses the first form
+and you still want to advertise claims, you can also override ``get_discovery_claims``.
+
+Using OIDC scopes to determine which claims are returned
+--------------------------------------------------------
+
+The ``oidc_claim_scope`` OAuth2Validator class attribute implements OIDC's
+`5.4 Requesting Claims using Scope Values`_ feature.
+For example, a ``given_name`` claim is only returned if the ``profile`` scope was granted.
+
+To change the list of claims and which scopes result in their being returned,
+override ``oidc_claim_scope`` with a dict keyed by claim with a value of scope.
+The following example adds instructions to return the ``foo`` claim when the ``bar`` scope is granted::
+    class CustomOAuth2Validator(OAuth2Validator):
+        oidc_claim_scope = OAuth2Validator.oidc_claim_scope
+        oidc_claim_scope.update({"foo": "bar"})
+
+Set ``oidc_claim_scope = None`` to return all claims irrespective of the granted scopes.
+
+You have to make sure you've added addtional claims via ``get_additional_claims``
+and defined the ``OAUTH2_PROVIDER["SCOPES"]`` in your settings in order for this functionality to work.
+
 .. note::
     This ``request`` object is not a ``django.http.Request`` object, but an
     ``oauthlib.common.Request`` object. This has a number of attributes that
     you can use to decide what claims to put in to the ID token:
 
-    * ``request.scopes`` - a list of the scopes requested by the client when
-      making an authorization request.
-    * ``request.claims`` - a dictionary of the requested claims, using the
-      `OIDC claims requesting system`_. These must be requested by the client
-      when making an authorization request.
-    * ``request.user`` - the django user object.
+    * ``request.scopes`` - the list of granted scopes.
+    * ``request.claims`` - the requested claims per OIDC's `5.5 Requesting Claims using the "claims" Request Parameter`_.
+      These must be requested by the client when making an authorization request.
+    * ``request.user`` - the `Django User`_ object.
 
-.. _OIDC claims requesting system: https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter
+.. _5.4 Requesting Claims using Scope Values: https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims
+.. _5.5 Requesting Claims using the "claims" Request Parameter: https://openid.net/specs/openid-connect-core-1_0.html#ClaimsParameter
+.. _Django User: https://docs.djangoproject.com/en/stable/ref/contrib/auth/#user-model
 
 What claims you decide to put in to the token is up to you to determine based
 upon what the scopes and / or claims means to your provider.
@@ -307,11 +341,11 @@ Adding information to the ``UserInfo`` service
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 The ``UserInfo`` service is supplied as part of the OIDC service, and is used
-to retrieve more information about the user than was supplied in the ID token
-when the user logged in to the OIDC client application. It is optional to use
-the service. The service is accessed by making a request to the
+to retrieve information about the user given their Access Token.
+It is optional to use the service. The service is accessed by making a request to the
 ``UserInfo`` endpoint, eg ``/o/userinfo/`` and supplying the access token
-retrieved at login as a ``Bearer`` token.
+retrieved at login as a ``Bearer`` token or as a form-encoded ``access_token`` body parameter
+for a POST request.
 
 Again, to modify the content delivered, we need to add a function to our
 custom validator. The default implementation adds the claims from the ID
diff --git a/oauth2_provider/oauth2_validators.py b/oauth2_provider/oauth2_validators.py
index 00c5e7de0..b33c80f39 100644
--- a/oauth2_provider/oauth2_validators.py
+++ b/oauth2_provider/oauth2_validators.py
@@ -65,6 +65,34 @@
 
 
 class OAuth2Validator(RequestValidator):
+    # Return the given claim only if the given scope is present.
+    # Extended as needed for non-standard OIDC claims/scopes.
+    # Override by setting to None to ignore scopes.
+    # see https://openid.net/specs/openid-connect-core-1_0.html#ScopeClaims
+    # For example, for the "nickname" claim, you need the "profile" scope.
+    oidc_claim_scope = {
+        "sub": "openid",
+        "name": "profile",
+        "family_name": "profile",
+        "given_name": "profile",
+        "middle_name": "profile",
+        "nickname": "profile",
+        "preferred_username": "profile",
+        "profile": "profile",
+        "picture": "profile",
+        "website": "profile",
+        "gender": "profile",
+        "birthdate": "profile",
+        "zoneinfo": "profile",
+        "locale": "profile",
+        "updated_at": "profile",
+        "email": "email",
+        "email_verified": "email",
+        "address": "address",
+        "phone_number": "phone",
+        "phone_number_verified": "phone",
+    }
+
     def _extract_basic_auth(self, request):
         """
         Return authentication string if request contains basic auth credentials,
@@ -397,7 +425,7 @@ def validate_bearer_token(self, token, scopes, request):
         if access_token and access_token.is_valid(scopes):
             request.client = access_token.application
             request.user = access_token.user
-            request.scopes = scopes
+            request.scopes = list(access_token.scopes)
 
             # this is needed by django rest framework
             request.access_token = access_token
@@ -759,8 +787,11 @@ def get_oidc_claims(self, token, token_handler, request):
         data = self.get_claim_dict(request)
         claims = {}
 
+        # TODO if request.claims then return only the claims requested, but limited by granted scopes.
+
         for k, v in data.items():
-            claims[k] = v(request) if callable(v) else v
+            if not self.oidc_claim_scope or self.oidc_claim_scope.get(k) in request.scopes:
+                claims[k] = v(request) if callable(v) else v
         return claims
 
     def get_id_token_dictionary(self, token, token_handler, request):
@@ -911,7 +942,7 @@ def get_userinfo_claims(self, request):
         current user's claims.
 
         """
-        return self.get_oidc_claims(None, None, request)
+        return self.get_oidc_claims(request.access_token, None, request)
 
     def get_additional_claims(self, request):
         return {}
diff --git a/tests/conftest.py b/tests/conftest.py
index 520b6cbac..14db54aa5 100644
--- a/tests/conftest.py
+++ b/tests/conftest.py
@@ -158,3 +158,43 @@ def oidc_tokens(oauth2_settings, application, test_user, client):
         id_token=token_data["id_token"],
         oauth2_settings=oauth2_settings,
     )
+
+
+@pytest.fixture
+def oidc_email_scope_tokens(oauth2_settings, application, test_user, client):
+    oauth2_settings.update(presets.OIDC_SETTINGS_EMAIL_SCOPE)
+    client.force_login(test_user)
+    auth_rsp = client.post(
+        reverse("oauth2_provider:authorize"),
+        data={
+            "client_id": application.client_id,
+            "state": "random_state_string",
+            "scope": "openid email",
+            "redirect_uri": "http://example.org",
+            "response_type": "code",
+            "allow": True,
+        },
+    )
+    assert auth_rsp.status_code == 302
+    code = parse_qs(urlparse(auth_rsp["Location"]).query)["code"]
+    client.logout()
+    token_rsp = client.post(
+        reverse("oauth2_provider:token"),
+        data={
+            "grant_type": "authorization_code",
+            "code": code,
+            "redirect_uri": "http://example.org",
+            "client_id": application.client_id,
+            "client_secret": CLEARTEXT_SECRET,
+            "scope": "openid email",
+        },
+    )
+    assert token_rsp.status_code == 200
+    token_data = token_rsp.json()
+    return SimpleNamespace(
+        user=test_user,
+        application=application,
+        access_token=token_data["access_token"],
+        id_token=token_data["id_token"],
+        oauth2_settings=oauth2_settings,
+    )
diff --git a/tests/presets.py b/tests/presets.py
index 438da1e03..fa2d7a34c 100644
--- a/tests/presets.py
+++ b/tests/presets.py
@@ -22,6 +22,8 @@
 }
 OIDC_SETTINGS_RO = deepcopy(OIDC_SETTINGS_RW)
 OIDC_SETTINGS_RO["DEFAULT_SCOPES"] = ["read"]
+OIDC_SETTINGS_EMAIL_SCOPE = deepcopy(OIDC_SETTINGS_RW)
+OIDC_SETTINGS_EMAIL_SCOPE["SCOPES"].update({"email": "return email address"})
 OIDC_SETTINGS_HS256_ONLY = deepcopy(OIDC_SETTINGS_RW)
 del OIDC_SETTINGS_HS256_ONLY["OIDC_RSA_PRIVATE_KEY"]
 REST_FRAMEWORK_SCOPES = {
diff --git a/tests/test_oidc_views.py b/tests/test_oidc_views.py
index 5eb9c2d77..7b379d1b3 100644
--- a/tests/test_oidc_views.py
+++ b/tests/test_oidc_views.py
@@ -160,6 +160,8 @@ def claim_user_email(request):
 @pytest.mark.django_db
 def test_userinfo_endpoint_custom_claims_callable(oidc_tokens, client, oauth2_settings):
     class CustomValidator(OAuth2Validator):
+        oidc_claim_scope = None
+
         def get_additional_claims(self):
             return {
                 "username": claim_user_email,
@@ -183,9 +185,38 @@ def get_additional_claims(self):
     assert data["email"] == EXAMPLE_EMAIL
 
 
+@pytest.mark.django_db
+def test_userinfo_endpoint_custom_claims_email_scope_callable(
+    oidc_email_scope_tokens, client, oauth2_settings
+):
+    class CustomValidator(OAuth2Validator):
+        def get_additional_claims(self):
+            return {
+                "username": claim_user_email,
+                "email": claim_user_email,
+            }
+
+    oidc_email_scope_tokens.oauth2_settings.OAUTH2_VALIDATOR_CLASS = CustomValidator
+    auth_header = "Bearer %s" % oidc_email_scope_tokens.access_token
+    rsp = client.get(
+        reverse("oauth2_provider:user-info"),
+        HTTP_AUTHORIZATION=auth_header,
+    )
+    data = rsp.json()
+    assert "sub" in data
+    assert data["sub"] == str(oidc_email_scope_tokens.user.pk)
+
+    assert "username" not in data
+
+    assert "email" in data
+    assert data["email"] == EXAMPLE_EMAIL
+
+
 @pytest.mark.django_db
 def test_userinfo_endpoint_custom_claims_plain(oidc_tokens, client, oauth2_settings):
     class CustomValidator(OAuth2Validator):
+        oidc_claim_scope = None
+
         def get_additional_claims(self, request):
             return {
                 "username": EXAMPLE_EMAIL,
@@ -207,3 +238,28 @@ def get_additional_claims(self, request):
 
     assert "email" in data
     assert data["email"] == EXAMPLE_EMAIL
+
+
+@pytest.mark.django_db
+def test_userinfo_endpoint_custom_claims_email_scopeplain(oidc_email_scope_tokens, client, oauth2_settings):
+    class CustomValidator(OAuth2Validator):
+        def get_additional_claims(self, request):
+            return {
+                "username": EXAMPLE_EMAIL,
+                "email": EXAMPLE_EMAIL,
+            }
+
+    oidc_email_scope_tokens.oauth2_settings.OAUTH2_VALIDATOR_CLASS = CustomValidator
+    auth_header = "Bearer %s" % oidc_email_scope_tokens.access_token
+    rsp = client.get(
+        reverse("oauth2_provider:user-info"),
+        HTTP_AUTHORIZATION=auth_header,
+    )
+    data = rsp.json()
+    assert "sub" in data
+    assert data["sub"] == str(oidc_email_scope_tokens.user.pk)
+
+    assert "username" not in data
+
+    assert "email" in data
+    assert data["email"] == EXAMPLE_EMAIL

From 769c8e7ba6ef33658d2b4f32065352af6e468ecf Mon Sep 17 00:00:00 2001
From: Brian Helba <brian.helba@kitware.com>
Date: Wed, 16 Feb 2022 10:36:02 -0500
Subject: [PATCH 04/20] Prevent the tests/migrations directory from getting
 packaged (#1118)

Simply excluding "tests" is not enough to prevent subpackages from also being
excluded. If a wildcard is provided to "find_packages(exclude=", it will only
match a single hierarchy level.

Without this, a directory "site-packages/tests/migrations" gets created upon
package install.
---
 AUTHORS   | 1 +
 setup.cfg | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/AUTHORS b/AUTHORS
index c6e66453d..69905c31f 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -21,6 +21,7 @@ Ash Christopher
 Asif Saif Uddin
 Bart Merenda
 Bas van Oostveen
+Brian Helba
 Dave Burkholder
 David Fischer
 David Smith
diff --git a/setup.cfg b/setup.cfg
index 4a8de4569..7fc5a9243 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -38,4 +38,6 @@ install_requires =
 	jwcrypto >= 0.8.0
 
 [options.packages.find]
-exclude = tests
+exclude =
+	tests
+	tests.*

From c48b7516fe6aebf89c5964e4855ecf129274c3c3 Mon Sep 17 00:00:00 2001
From: David Hill <dave@muscovy.net>
Date: Wed, 23 Feb 2022 15:52:28 -0500
Subject: [PATCH 05/20] Topic/1112 (#1113)

---
 AUTHORS                       |  1 +
 docs/tutorial/tutorial_03.rst | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/AUTHORS b/AUTHORS
index 69905c31f..2ba7f3325 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -70,3 +70,4 @@ Vinay Karanam
 Eduardo Oliveira
 Andrea Greco
 Dominik George
+David Hill
diff --git a/docs/tutorial/tutorial_03.rst b/docs/tutorial/tutorial_03.rst
index 52868c01f..30c8317e6 100644
--- a/docs/tutorial/tutorial_03.rst
+++ b/docs/tutorial/tutorial_03.rst
@@ -78,3 +78,35 @@ Now supposing your access token value is `123456` you can try to access your aut
 ::
 
     curl -H "Authorization: Bearer 123456" -X GET http://localhost:8000/secret
+
+Working with Rest_framework generic class based views
+-----------------------------------------------------
+
+If you have completed the `Django REST framework tutorial
+<https://www.django-rest-framework.org/tutorial/3-class-based-views/#using-generic-class-based-views>`_,
+you will be familiar with the 'Snippet' example, in particular the SnippetList and SnippetDetail classes.
+
+It would be nice to reuse those views **and** support token handling. Instead of reworking
+those classes to be ProtectedResourceView based, the solution is much simpler than that.
+
+Assume you have already modified the settings as was already shown.
+The key is setting a class attribute to override the default *permissions_classes* with something that will use our :term:`Access Token` properly.
+
+.. code-block:: python
+
+    from oauth2_provider.contrib.rest_framework import TokenHasReadWriteScope
+
+    class SnippetList(generics.ListCreateAPIView):
+        ...
+        permission_classes = [TokenHasReadWriteScope]
+
+    class SnippetDetail(generics.ListCreateAPIView):
+        ...
+        permission_classes = [TokenHasReadWriteScope]
+
+Note that this example overrides the Django default permission class setting. There are several other
+ways this can be solved. Overriding the class function *get_permission_classes* is another way
+to solve the problem.
+
+A detailed dive into the `Dango REST framework permissions is here. <https://www.django-rest-framework.org/api-guide/permissions/>`_
+

From 5531cb92b43126565216610e320881f34639a9a1 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Fri, 18 Mar 2022 14:45:07 -0400
Subject: [PATCH 06/20] [pre-commit.ci] pre-commit autoupdate (#1109)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

updates:
- [github.com/psf/black: 21.12b0 → 22.1.0](https://github.com/psf/black/compare/21.12b0...22.1.0)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Co-authored-by: Alan Crosswell <alan@columbia.edu>
---
 .pre-commit-config.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 5c78568ea..3b883f488 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,6 +1,6 @@
 repos:
   - repo: https://github.com/psf/black
-    rev: 21.12b0
+    rev: 22.1.0
     hooks:
       - id: black
         exclude: ^(oauth2_provider/migrations/|tests/migrations/)

From e761ebc22fbac1aa1837c3f851fe3bac38421331 Mon Sep 17 00:00:00 2001
From: Carl Schwan <carl@carlschwan.eu>
Date: Fri, 18 Mar 2022 20:35:26 +0100
Subject: [PATCH 07/20] Fix broken import in doc (#1121)

* Fix broken import in doc

* Add Carl Schwan to AUTHORS

Co-authored-by: Alan Crosswell <alan@columbia.edu>
---
 AUTHORS       | 1 +
 docs/oidc.rst | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/AUTHORS b/AUTHORS
index 2ba7f3325..7f3f21276 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -22,6 +22,7 @@ Asif Saif Uddin
 Bart Merenda
 Bas van Oostveen
 Brian Helba
+Carl Schwan
 Dave Burkholder
 David Fischer
 David Smith
diff --git a/docs/oidc.rst b/docs/oidc.rst
index 8dfea2e16..f4fdfd09c 100644
--- a/docs/oidc.rst
+++ b/docs/oidc.rst
@@ -80,7 +80,7 @@ Now we need to add this key to our settings and allow the ``openid`` scope to
 be used. Assuming we have set an environment variable called
 ``OIDC_RSA_PRIVATE_KEY``, we can make changes to our ``settings.py``::
 
-    import os.environ
+    import os
 
     OAUTH2_PROVIDER = {
         "OIDC_ENABLED": True,

From fc291ce040f2eec6722cca9882eac88ec49b2250 Mon Sep 17 00:00:00 2001
From: Alan Crosswell <alan@columbia.edu>
Date: Sat, 19 Mar 2022 14:30:02 -0400
Subject: [PATCH 08/20] Security BCP: Remove OOB (#1124)

* Remove OOB

* Indicate that this is a security fix.
---
 CHANGELOG.md                                  |  6 ++
 .../oauth2_provider/authorized-oob.html       | 23 -----
 oauth2_provider/views/base.py                 | 36 +-------
 tests/test_authorization_code.py              | 90 -------------------
 4 files changed, 8 insertions(+), 147 deletions(-)
 delete mode 100644 oauth2_provider/templates/oauth2_provider/authorized-oob.html

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 23035d0b2..c3b10068b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -36,6 +36,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Fixed
 * #1108 OIDC: Fix `validate_bearer_token()` to properly set `request.scopes` to the list of granted scopes.
 
+### Removed
+* #1124 (**Breaking**, **Security**) Removes support for insecure `urn:ietf:wg:oauth:2.0:oob` and `urn:ietf:wg:oauth:2.0:oob:auto` which are replaced
+  by [RFC 8252](https://datatracker.ietf.org/doc/html/rfc8252) "OAuth 2.0 for Native Apps" BCP. Google has
+  [deprecated use of oob](https://developers.googleblog.com/2022/02/making-oauth-flows-safer.html?m=1#disallowed-oob) with
+  a final end date of 2022-10-03. If you still rely on oob support in django-oauth-toolkit, do not upgrade to this release.
+
 ## [1.7.0] 2022-01-23
 
 ### Added
diff --git a/oauth2_provider/templates/oauth2_provider/authorized-oob.html b/oauth2_provider/templates/oauth2_provider/authorized-oob.html
deleted file mode 100644
index 78399da7c..000000000
--- a/oauth2_provider/templates/oauth2_provider/authorized-oob.html
+++ /dev/null
@@ -1,23 +0,0 @@
-{% extends "oauth2_provider/base.html" %}
-
-{% load i18n %}
-
-{% block title %}
-Success code={{code}}
-{% endblock %}
-
-{% block content %}
-    <div class="block-center">
-        {% if not error %}
-            <h2>{% trans "Success" %}</h2>
-
-            <p>{% trans "Please return to your application and enter this code:" %}</p>
-
-            <p><code>{{ code }}</code></p>
-
-        {% else %}
-            <h2>Error: {{ error.error }}</h2>
-            <p>{{ error.description }}</p>
-        {% endif %}
-    </div>
-{% endblock %}
diff --git a/oauth2_provider/views/base.py b/oauth2_provider/views/base.py
index e46a49d10..211da45ed 100644
--- a/oauth2_provider/views/base.py
+++ b/oauth2_provider/views/base.py
@@ -1,11 +1,8 @@
 import json
 import logging
-import urllib.parse
 
 from django.contrib.auth.mixins import LoginRequiredMixin
-from django.http import HttpResponse, JsonResponse
-from django.shortcuts import render
-from django.urls import reverse
+from django.http import HttpResponse
 from django.utils import timezone
 from django.utils.decorators import method_decorator
 from django.views.decorators.csrf import csrf_exempt
@@ -207,42 +204,13 @@ def get(self, request, *args, **kwargs):
                             credentials=credentials,
                             allow=True,
                         )
-                        return self.redirect(uri, application, token)
+                        return self.redirect(uri, application)
 
         except OAuthToolkitError as error:
             return self.error_response(error, application)
 
         return self.render_to_response(self.get_context_data(**kwargs))
 
-    def redirect(self, redirect_to, application, token=None):
-
-        if not redirect_to.startswith("urn:ietf:wg:oauth:2.0:oob"):
-            return super().redirect(redirect_to, application)
-
-        parsed_redirect = urllib.parse.urlparse(redirect_to)
-        code = urllib.parse.parse_qs(parsed_redirect.query)["code"][0]
-
-        if redirect_to.startswith("urn:ietf:wg:oauth:2.0:oob:auto"):
-
-            response = {
-                "access_token": code,
-                "token_uri": redirect_to,
-                "client_id": application.client_id,
-                "client_secret": application.client_secret,
-                "revoke_uri": reverse("oauth2_provider:revoke-token"),
-            }
-
-            return JsonResponse(response)
-
-        else:
-            return render(
-                request=self.request,
-                template_name="oauth2_provider/authorized-oob.html",
-                context={
-                    "code": code,
-                },
-            )
-
 
 @method_decorator(csrf_exempt, name="dispatch")
 class TokenView(OAuthLibMixin, View):
diff --git a/tests/test_authorization_code.py b/tests/test_authorization_code.py
index 91fd06bd1..25447b9dd 100644
--- a/tests/test_authorization_code.py
+++ b/tests/test_authorization_code.py
@@ -2,7 +2,6 @@
 import datetime
 import hashlib
 import json
-import re
 from urllib.parse import parse_qs, urlparse
 
 import pytest
@@ -32,8 +31,6 @@
 RefreshToken = get_refresh_token_model()
 UserModel = get_user_model()
 
-URI_OOB = "urn:ietf:wg:oauth:2.0:oob"
-URI_OOB_AUTO = "urn:ietf:wg:oauth:2.0:oob:auto"
 CLEARTEXT_SECRET = "1234567890abcdefghijklmnopqrstuvwxyz"
 
 
@@ -56,7 +53,6 @@ def setUp(self):
             name="Test Application",
             redirect_uris=(
                 "http://localhost http://example.com http://example.org custom-scheme://example.com"
-                " " + URI_OOB + " " + URI_OOB_AUTO
             ),
             user=self.dev_user,
             client_type=Application.CLIENT_CONFIDENTIAL,
@@ -1532,92 +1528,6 @@ def test_code_exchange_succeed_when_redirect_uri_match_with_multiple_query_param
         self.assertEqual(content["scope"], "read write")
         self.assertEqual(content["expires_in"], self.oauth2_settings.ACCESS_TOKEN_EXPIRE_SECONDS)
 
-    def test_oob_as_html(self):
-        """
-        Test out-of-band authentication.
-        """
-        self.client.login(username="test_user", password="123456")
-
-        authcode_data = {
-            "client_id": self.application.client_id,
-            "state": "random_state_string",
-            "scope": "read write",
-            "redirect_uri": URI_OOB,
-            "response_type": "code",
-            "allow": True,
-        }
-
-        response = self.client.post(reverse("oauth2_provider:authorize"), data=authcode_data)
-        self.assertEqual(response.status_code, 200)
-        self.assertRegex(response["Content-Type"], r"^text/html")
-
-        content = response.content.decode("utf-8")
-
-        # "A lot of applications, for legacy reasons, use this and regex
-        # to extract the token, risking summoning zalgo in the process."
-        #    -- https://github.com/jazzband/django-oauth-toolkit/issues/235
-
-        matches = re.search(r".*<code>([^<>]*)</code>", content)
-        self.assertIsNotNone(matches, msg="OOB response contains code inside <code> tag")
-        self.assertEqual(len(matches.groups()), 1, msg="OOB response contains multiple <code> tags")
-        authorization_code = matches.groups()[0]
-
-        token_request_data = {
-            "grant_type": "authorization_code",
-            "code": authorization_code,
-            "redirect_uri": URI_OOB,
-            "client_id": self.application.client_id,
-            "client_secret": CLEARTEXT_SECRET,
-        }
-
-        response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data)
-        self.assertEqual(response.status_code, 200)
-
-        content = json.loads(response.content.decode("utf-8"))
-        self.assertEqual(content["token_type"], "Bearer")
-        self.assertEqual(content["scope"], "read write")
-        self.assertEqual(content["expires_in"], self.oauth2_settings.ACCESS_TOKEN_EXPIRE_SECONDS)
-
-    def test_oob_as_json(self):
-        """
-        Test out-of-band authentication, with a JSON response.
-        """
-        self.client.login(username="test_user", password="123456")
-
-        authcode_data = {
-            "client_id": self.application.client_id,
-            "state": "random_state_string",
-            "scope": "read write",
-            "redirect_uri": URI_OOB_AUTO,
-            "response_type": "code",
-            "allow": True,
-        }
-
-        response = self.client.post(reverse("oauth2_provider:authorize"), data=authcode_data)
-        self.assertEqual(response.status_code, 200)
-        self.assertRegex(response["Content-Type"], "^application/json")
-
-        parsed_response = json.loads(response.content.decode("utf-8"))
-
-        self.assertIn("access_token", parsed_response)
-        authorization_code = parsed_response["access_token"]
-
-        token_request_data = {
-            "grant_type": "authorization_code",
-            "code": authorization_code,
-            "redirect_uri": URI_OOB_AUTO,
-            "client_id": self.application.client_id,
-            "client_secret": CLEARTEXT_SECRET,
-        }
-
-        response = self.client.post(reverse("oauth2_provider:token"), data=token_request_data)
-        self.assertEqual(response.status_code, 200)
-
-        content = json.loads(response.content.decode("utf-8"))
-        self.assertEqual(content["token_type"], "Bearer")
-        self.assertEqual(content["scope"], "read write")
-        self.assertEqual(content["expires_in"], self.oauth2_settings.ACCESS_TOKEN_EXPIRE_SECONDS)
-
 
 @pytest.mark.oauth2_settings(presets.OIDC_SETTINGS_RW)
 class TestOIDCAuthorizationCodeTokenView(BaseAuthorizationCodeTokenView):

From 2212144242f650207f71525eb088413e81587208 Mon Sep 17 00:00:00 2001
From: Alan Crosswell <alan@columbia.edu>
Date: Sat, 19 Mar 2022 18:25:34 -0400
Subject: [PATCH 09/20] Revert 1070 (Celery tasks.py) (#1126)

* Revert #1070: tasks.py raises an import exception with Celery and conflicts with Huey.
---
 CHANGELOG.md                 | 7 +++++++
 docs/management_commands.rst | 5 -----
 oauth2_provider/tasks.py     | 8 --------
 3 files changed, 7 insertions(+), 13 deletions(-)
 delete mode 100644 oauth2_provider/tasks.py

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c3b10068b..e6b089f5f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -42,6 +42,13 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   [deprecated use of oob](https://developers.googleblog.com/2022/02/making-oauth-flows-safer.html?m=1#disallowed-oob) with
   a final end date of 2022-10-03. If you still rely on oob support in django-oauth-toolkit, do not upgrade to this release.
 
+## [1.7.1] 2022-03-19
+
+### Removed
+* #1126 Reverts #1070 which incorrectly added Celery auto-discovery tasks.py (as described in #1123) and because it conflicts
+  with Huey's auto-discovery which also uses tasks.py as described in #1114. If you are using Celery or Huey, you'll need
+  to separately implement these tasks.
+
 ## [1.7.0] 2022-01-23
 
 ### Added
diff --git a/docs/management_commands.rst b/docs/management_commands.rst
index 727ff9e98..147a0bbe4 100644
--- a/docs/management_commands.rst
+++ b/docs/management_commands.rst
@@ -21,8 +21,3 @@ To prevent the CPU and RAM high peaks during deletion process use ``CLEAR_EXPIRE
 
 Note: Refresh tokens need to expire before AccessTokens can be removed from the
 database. Using ``cleartokens`` without ``REFRESH_TOKEN_EXPIRE_SECONDS`` has limited effect.
-
-The ``cleartokens`` action can also be scheduled as a `Celery periodic task`_
-by using the ``clear_tokens`` task (automatically registered when using Celery).
-
-.. _Celery periodic task: https://docs.celeryproject.org/en/stable/userguide/periodic-tasks.html
diff --git a/oauth2_provider/tasks.py b/oauth2_provider/tasks.py
deleted file mode 100644
index d86c33720..000000000
--- a/oauth2_provider/tasks.py
+++ /dev/null
@@ -1,8 +0,0 @@
-from celery import shared_task
-
-
-@shared_task
-def clear_tokens():
-    from ...models import clear_expired  # noqa
-
-    clear_expired()

From 56c8c66b11d01991897858082e1b9ff38b260ea3 Mon Sep 17 00:00:00 2001
From: Alan Crosswell <alan@columbia.edu>
Date: Sun, 27 Mar 2022 08:42:05 -0400
Subject: [PATCH 10/20] Pin Jinja2 version per
 https://github.com/sphinx-doc/sphinx/issues/10291 (#1134)

---
 tox.ini | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tox.ini b/tox.ini
index 03241132f..7232ecef7 100644
--- a/tox.ini
+++ b/tox.ini
@@ -64,6 +64,7 @@ commands =
     docs: make html
     livedocs: make livehtml
 deps =
+    Jinja2<3.1
     sphinx<3
     oauthlib>=3.1.0
     m2r>=0.2.1

From a62195b20edf03c755a476416b2e79d65899505b Mon Sep 17 00:00:00 2001
From: Alan Crosswell <alan@columbia.edu>
Date: Sun, 27 Mar 2022 09:01:52 -0400
Subject: [PATCH 11/20] Missed updating master branch version to 1.7.1 (#1133)

---
 oauth2_provider/__init__.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/oauth2_provider/__init__.py b/oauth2_provider/__init__.py
index 805f886e8..9024b6f63 100644
--- a/oauth2_provider/__init__.py
+++ b/oauth2_provider/__init__.py
@@ -1,7 +1,7 @@
 import django
 
 
-__version__ = "1.7.0"
+__version__ = "1.7.1"
 
 if django.VERSION < (3, 2):
     default_app_config = "oauth2_provider.apps.DOTConfig"

From c8eee2cea6c937951dd23d9dee2f2dbfaecabd01 Mon Sep 17 00:00:00 2001
From: Daniel <vector.kerr@gmail.com>
Date: Tue, 29 Mar 2022 00:35:48 +1100
Subject: [PATCH 12/20] Update `createapplication` command (#1132)

* Add --algorithm argument and fix --skip-authorization help text for createapplication command

* Add unit test for update to createapplication command

* Add to AUTHORS

* Update changelog for createapplication command changes

* Add documentation for 'createapplication' command to 'management_commands.rst'

Co-authored-by: Alan Crosswell <alan@crosswell.us>
---
 AUTHORS                                       |  1 +
 CHANGELOG.md                                  |  2 +
 docs/management_commands.rst                  | 37 +++++++++++++++++++
 .../management/commands/createapplication.py  |  7 +++-
 tests/test_commands.py                        | 17 +++++++++
 5 files changed, 63 insertions(+), 1 deletion(-)

diff --git a/AUTHORS b/AUTHORS
index 7f3f21276..962cc7d00 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -23,6 +23,7 @@ Bart Merenda
 Bas van Oostveen
 Brian Helba
 Carl Schwan
+Daniel 'Vector' Kerr
 Dave Burkholder
 David Fischer
 David Smith
diff --git a/CHANGELOG.md b/CHANGELOG.md
index e6b089f5f..da0fede00 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -32,9 +32,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   If you've [customized OIDC responses](https://django-oauth-toolkit.readthedocs.io/en/latest/oidc.html#customizing-the-oidc-responses)
   and want to retain the pre-2.x behavior, set `oidc_claim_scope = None` in your subclass of `OAuth2Validator`.
 * #1108 OIDC: Make the `access_token` available to `get_oidc_claims` when called from `get_userinfo_claims`.
+* #1132: Added `--algorithm` argument to `createapplication` management command
 
 ### Fixed
 * #1108 OIDC: Fix `validate_bearer_token()` to properly set `request.scopes` to the list of granted scopes.
+* #1132: Fixed help text for `--skip-authorization` argument of the `createapplication` management command
 
 ### Removed
 * #1124 (**Breaking**, **Security**) Removes support for insecure `urn:ietf:wg:oauth:2.0:oob` and `urn:ietf:wg:oauth:2.0:oob:auto` which are replaced
diff --git a/docs/management_commands.rst b/docs/management_commands.rst
index 147a0bbe4..956ce9ef9 100644
--- a/docs/management_commands.rst
+++ b/docs/management_commands.rst
@@ -4,6 +4,8 @@ Management commands
 Django OAuth Toolkit exposes some useful management commands that can be run via shell or by other means (eg: cron)
 
 .. _cleartokens:
+.. _createapplication:
+
 
 cleartokens
 ~~~~~~~~~~~
@@ -21,3 +23,38 @@ To prevent the CPU and RAM high peaks during deletion process use ``CLEAR_EXPIRE
 
 Note: Refresh tokens need to expire before AccessTokens can be removed from the
 database. Using ``cleartokens`` without ``REFRESH_TOKEN_EXPIRE_SECONDS`` has limited effect.
+
+
+
+createapplication
+~~~~~~~~~~~~~~~~~
+
+The ``createapplication`` management command provides a shortcut to create a new application in a programmatic way.
+
+.. code-block:: sh
+
+    usage: manage.py createapplication [-h] [--client-id CLIENT_ID] [--user USER] [--redirect-uris REDIRECT_URIS]
+				       [--client-secret CLIENT_SECRET] [--name NAME] [--skip-authorization] [--version] [-v {0,1,2,3}]
+				       [--settings SETTINGS] [--pythonpath PYTHONPATH] [--traceback] [--no-color] [--force-color]
+				       [--skip-checks]
+				       client_type authorization_grant_type
+
+    Shortcut to create a new application in a programmatic way
+
+    positional arguments:
+      client_type           The client type, can be confidential or public
+      authorization_grant_type
+			    The type of authorization grant to be used
+
+    optional arguments:
+      -h, --help            show this help message and exit
+      --client-id CLIENT_ID
+			    The ID of the new application
+      --user USER           The user the application belongs to
+      --redirect-uris REDIRECT_URIS
+			    The redirect URIs, this must be a space separated string e.g 'URI1 URI2'
+      --client-secret CLIENT_SECRET
+			    The secret for this application
+      --name NAME           The name this application
+      --skip-authorization  The ID of the new application
+      ...
diff --git a/oauth2_provider/management/commands/createapplication.py b/oauth2_provider/management/commands/createapplication.py
index 92c4ae46b..f8575a8b0 100644
--- a/oauth2_provider/management/commands/createapplication.py
+++ b/oauth2_provider/management/commands/createapplication.py
@@ -49,7 +49,12 @@ def add_arguments(self, parser):
         parser.add_argument(
             "--skip-authorization",
             action="store_true",
-            help="The ID of the new application",
+            help="If set, completely bypass the authorization form, even on the first use of the application",
+        )
+        parser.add_argument(
+            "--algorithm",
+            type=str,
+            help="The OIDC token signing algorithm for this application (e.g., 'RS256' or 'HS256')",
         )
 
     def handle(self, *args, **options):
diff --git a/tests/test_commands.py b/tests/test_commands.py
index 13b0eeb3d..f9a9f5ade 100644
--- a/tests/test_commands.py
+++ b/tests/test_commands.py
@@ -1,5 +1,6 @@
 from io import StringIO
 
+import pytest
 from django.contrib.auth import get_user_model
 from django.contrib.auth.hashers import check_password
 from django.core.management import call_command
@@ -8,6 +9,8 @@
 
 from oauth2_provider.models import get_application_model
 
+from . import presets
+
 
 Application = get_application_model()
 
@@ -112,6 +115,20 @@ def test_application_created_with_user(self):
 
         self.assertEqual(app.user, user)
 
+    @pytest.mark.usefixtures("oauth2_settings")
+    @pytest.mark.oauth2_settings(presets.OIDC_SETTINGS_RW)
+    def test_application_created_with_algorithm(self):
+        call_command(
+            "createapplication",
+            "confidential",
+            "authorization-code",
+            "--redirect-uris=http://example.com http://example2.com",
+            "--algorithm=RS256",
+        )
+        app = Application.objects.get()
+
+        self.assertEqual(app.algorithm, "RS256")
+
     def test_validation_failed_message(self):
         output = StringIO()
         call_command(

From e8ffc9ca31975d1e281d199609356057a612f109 Mon Sep 17 00:00:00 2001
From: Alan Crosswell <alan@columbia.edu>
Date: Mon, 28 Mar 2022 13:06:16 -0400
Subject: [PATCH 13/20] Add tutorial for Celery task setup. (#1128)

* Add tutorial for Celery task setup.
---
 CHANGELOG.md                   |   2 +
 docs/management_commands.rst   |   3 +-
 docs/tutorial/admin+celery.png | Bin 0 -> 67088 bytes
 docs/tutorial/celery+add.png   | Bin 0 -> 72877 bytes
 docs/tutorial/tutorial.rst     |   2 +
 docs/tutorial/tutorial_05.rst  | 169 +++++++++++++++++++++++++++++++++
 6 files changed, 175 insertions(+), 1 deletion(-)
 create mode 100644 docs/tutorial/admin+celery.png
 create mode 100644 docs/tutorial/celery+add.png
 create mode 100644 docs/tutorial/tutorial_05.rst

diff --git a/CHANGELOG.md b/CHANGELOG.md
index da0fede00..148d5e50e 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 ### Added
 * #1106 OIDC: Add "scopes_supported" to the [ConnectDiscoveryInfoView](https://django-oauth-toolkit.readthedocs.io/en/latest/oidc.html#connectdiscoveryinfoview).
   This completes the view to provide all the REQUIRED and RECOMMENDED [OpenID Provider Metadata](https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderMetadata).
+* #1128 Documentation: [Tutorial](https://django-oauth-toolkit.readthedocs.io/en/latest/tutorial/tutorial_05.html)
+  on using Celery to automate clearing expired tokens.
 
 ### Changed
 * #1093 (**Breaking**) Changed to implement [hashed](https://docs.djangoproject.com/en/stable/topics/auth/passwords/)
diff --git a/docs/management_commands.rst b/docs/management_commands.rst
index 956ce9ef9..3029f1345 100644
--- a/docs/management_commands.rst
+++ b/docs/management_commands.rst
@@ -1,7 +1,8 @@
 Management commands
 ===================
 
-Django OAuth Toolkit exposes some useful management commands that can be run via shell or by other means (eg: cron)
+Django OAuth Toolkit exposes some useful management commands that can be run via shell or by other means such as cron
+or :doc:`Celery <tutorial/tutorial_05>`.
 
 .. _cleartokens:
 .. _createapplication:
diff --git a/docs/tutorial/admin+celery.png b/docs/tutorial/admin+celery.png
new file mode 100644
index 0000000000000000000000000000000000000000..b9e25ea1977357a1900d9250bccf8c6ba583d00c
GIT binary patch
literal 67088
zcmeFZWmH_jwy28+N$}wA!GpU6f(8lh?(Q`17TjGzg1fuB2X~jo-Su|%j-7kPc>msb
ze;#8sy{J_(YnH6}&8i|qR$3GR9tR!_3=BbBOjr&K3?dEmX@GqN3PGiQCISNk=Q9-&
zk`)&cB9gVUHZrv^1Os~)t*@iAAx`_QUsqR0r+<Wo3f|6HE;u+$PRFaaeVC}fy@#kH
zD>F$$V+{*=4N{>K?Azy#I`cPSME8~S{j`*`+R$>j62w&z9+pQ#9##1Ayzpxh;&jrl
zCcL~kh#Ru<{e65GU-c`|Gf;t5;Cfp`lVpAKKBOXY;_`2S=$7^^zww^-hvI~s$Mm-F
z*$V4^OY{I9RTAq@mJ!h%xbPan0$ijwmjDV+g8H3!$vg1z(L3n)kI8%3<nR&gKg1PJ
zhb3nwKfh;s&!ndV7QiZe1;kx@Z}4_gAQ&C2B8LbP@`Bi3C598S>ss~An;2hM#`wE8
zZyvwCd9#=ej~a@)j;Qn4E0<<u0i|mXx#{D$@bZ$`g^e}GijDQG_44v^a}D}M51HZ>
z>a*U?4wiVU(OAFwF%qOuB|{Z)BPl5`YS29_7<iB=7!>FZ9Q45feZasVV*<foK;NjK
zk8l>m@23!HS&)D38-7L<lot{g2Yt)y+Zh^K*_&89EC+d3fwG!0RZwwIk^01?Z*57h
zYhbNsNDr{I`I!Wa2fziowKR0lB?4GlSlM#{cuD>fg9~*3Gnj#d=s!^$%y~&vq-2SN
ztnCbm*y!KWzbD~?Cn6%^u`@8@k`osBl^paJFNukRgAEr0gR`?Uy)!etwVg2oBPS;(
z!+RzMCMG&i3_5!kD+gTwos~W5e>3@=kFcS=zMZL!gQ>L@(a(H!^{gEocu7cp7WC)m
zzj7J^O#hZ-W&f*Mpb9ele8Rv;|DNGb-k_vBKSQ}>O#y}$s=}t0AoYOC;A7)t=lM_k
z|Mlc=iT|Wj`6neC$G<86dGdd!RJ1p=6SB4h73skDw`G1M{`cXpgggvCYyOWW{;THy
zgo5<U2hYRsr_K1_p;5oS2LlrT6Bia#0DvE+!vGW%?|b>>;K<?N$ce!}oV56PqeBVz
z_y%aYt!ggrFU(w>EHvetpXATURzT<pewRFH2?7J3aO-?=8{3k$qF^5Q&INgL!=rng
z<~G^@d>%a==3c#PwLd_3S|siB7l9xX_<Pj|6J;gb8`k|BMy3NRYjf`RPb@OoBB*y9
z=I9LEl;EgDzpt#dEn{yeu|HRq5}d5f47HY%^xyo+1Ud%Bz~G|(TmmJiS!>0L&4+3K
zr1bWU&HSC~&+L8F$OSr7ivaVS|D*(irsRkGSI!y<Z{I4VvwJ6?6fSV^HUox?jij#*
zW^g?EcWJk*K3R=;Pv5~qQ1N8%$B#@o1uGB4Jm#b3RL(<r4pv)B<hPczg0{l%&MI$A
zR5TGE>RV>=BSg3E*F(<NCwN?}KNqRBjH$~k5+}R(ocA`*OgBnLCYajowUfE%3#J`%
zOqHv7+{taGY-~#2bXWYUruWAzX=os;(2e>m-G$nBE{B2R-t+Ear<i1QCl&VaIU37s
zJH_h5L`vg2n#m04R!O49&lzC{PTg-#pFY~gq!OxZcWAM)e0HrKj_cHa*m^GGR&2=Z
zy}HOzw+OUQ9Czg){XY1lkh|XQ|5khyHUWPiC%{hXykHohlK4xj`(Ff94V8zKM~4xj
zUfgF_G;*|B^e1XfYcC^)qMl1848>9%?sf-R?GAwHgYHyqr5Pg^u7pvhUfnb2u=5^L
zXx>?=EmRU-Vo(Z_7J3>d^rlpa*D`XE78*5yE_QjO=aHY?wnL{!wx%1VFB)B$qh1k1
zpZEJ)?vEhFoAV!jE)<tKr<!J5{jHHm<b3;%WO*zi^XmX^Yp<&n*yIX1GM0K-0$#V!
zONEnZd!S{)>(za_JGI%$9Bxu*FP0aw)62tJR;JTww@zrUzSQZrnVaFSPlEna!?jx?
z+3eltt%nY#1O7Z`MuMzYUq9NV_C6}kbatKRC>ODq5@<D$VF5B-dvoBlS}Fp+LN^wt
z=APw$Tv1?mgqTWQ%r#AL2ocA`Q||lGYFYJZQdvy)>#XKiDMeKO_8R+7fqe)5dy&wm
z<{GQqo&?+zXd^7qaI^3ZAy;%|;Rg-36!Q}_e2Sfp^Ub-%LKmM*v6D4(n+iuiCPy^C
zYX{=oK(EAC40^WGOtK%u{I@@PvqSAKb*YYL5j?iGG_$(2gqbB$%Pdf@x(`Zo7WL`6
ztTj1R+PI+sv1x~198dWg^2Y?>5b06ug5lDuI3;q2P35VvO+S=D8c|(&U2KriP|B9_
zQhg@rlJK8cFD7a@D2k|juz>`!7W=J~$Zfy$S|tWj2h(w<pyv}q;BWD(t-Pz29d)TG
za~y2`fXv6?S#)V0Pkgl>pVsL}aNn9<yt-Qdz1;WP%($xE&2IXHU>EYC69=;j!2@GQ
z2@uJ5SN96<W-=<kd*cA}?M!R{cbDOl&qRg)?!`H=o8fso<oWI447K#d)`#scgkbOA
zFQ=kX*Lkd{PT2bz>a9N6iNE;e+~&|s!g!g`oN6o{HQ^>mig<c!Tq+S7pM3*bB!HJp
zPNy!*(-Wq>%X8$S)+Hvln5AHg^YWS$tUQ<C%T-2P)Gxg|WGFG%S=bqE^@R-GI%Ztl
zCVN_%;{+BYy6;b5oDWPS<Q~7qw1}dwP#tvwnv&o=N9?tvU)gD2s8;ZiTGM@rr>A3L
zog$TjF3<1NG<Y0(l2W$@ZZO=>H(SWYT(|}cWjsY1?mWfb&!<&=E#P$O>oapW3SPFe
z8WTdbc<nKwlwf^uYg8OoQJAc3eyDiop12=u{c9G?dIcBf9y_a(H@ydsy(?}?EOO{z
z5lyU)$ilP?4a3z<<{z+}kybCRFTfnGGv`^~TD&x?a^IaJxtNcKy?hre9JD>a%gn`{
z3NnKhGFR^M9jr3QspbXGM;3DB^3BYIA6P=Hk{B4$+QcbZ$3-7#KL?X?6C^zJ9<t~e
zNmd$7pIE<3SGaXF$)J;`pEI~;pr$T}ga}@L(X8$u<2Kxa>fcyikNK9d)L|)?WBLuk
z<=J=SeDH*Bdk7u9FQ=3HexV09%tTmw=$a)#Ury##ty9=tfqiX1E1_d7uc(CaY1>tz
zBPwPx4YF3KGh4!;ufQH*X6a1|wGi6GaQ)GXiaVt_1)zw+B__u<vCS$Z?#;-1!g;=r
zYU~5?#_>qqkJCceG;IQRx*l-`1z<S&8z{g`4&x$?Q==2P0c~(DFJjqZw%1e{LtdE;
z%frMwNH^0ey#0BOVvGZVNEtPX$B)^eRf;BOk?^z2h{xl6L~OR12eCN2(yzV_a!T>$
z-WjEZA7BoqUZ@SwhLcNuLW=g^#WT(Gf|2txOoz7)E6xJ6mW=iHcpxPaVg}qt``j)U
zG*PuvGh@<Rd2W!}vlx6A3#^kugY606#v=w-M~r{Wx9x+OZPcBzA`NB?>}kR&S}U{O
zDGT>(ePPqfgukwq8<3xwqj|XNtuguaa*|bta+kK*5V^?-#OX-RlKhsi<^TgW1Vm01
z6G?uw8k5U-PfP0QI)bye$|Y33YGCJTQb13{#*S}6^m6;XsOoXMf#gK9LPQT2IIx!<
zyWJN)k_NQmbBRPrEu%A`noNv`6$ZTLZ!oJtp~%T8#~LHyQA<S%9I(uEq}n#cU%bd#
z%JtAw&(36Hi?2S^0oE+xFO~Vi6AZFn-DfV8Mm8!Vt&(D1O+HJ{lh>K6_!@p|B4pA-
z%RWs(YLrZIC8ul3TJ>y@E;||^Vl%cfAsHK`nnzjd(T*6PR4!wKz|pghb`^iQkP<b<
zEZZALLt~d%z5TRF<>6xGd!gY1lhk#S*xe5kDv9c&m8wjXsa-WV%&;?YyzOxG`YQx-
z>M5J{y|neynJmd8cb!-wCjAmE<|UsA6wujR4fdH<X6;cknjkiCZ6KqL?gPQ|SC0Zh
z!uaISnvivBr7o%Z-qQo+fsRWZ7xx5G)6pwFjaB`y)7A}`UW9v2-lQGm=KP>?A9hD_
zopOqW^r`3a$5y&Vg$vM3EXlfq`^$LA*M;Ci>oRRC(-g(mE~ax3uj4t$wskzkYH4H1
z4I}aqxU($MS9SJweXEHu^zCN!9g5`4-5w1-$z<yxSMf4RI1KF+ou#ith*b4}eB}C(
zwgVG^QV~)!2^>5DKdtuawTo#*$OV6~DLubs1PjUe=%jO2zJ__$lkVP<qDA)j;_Ho(
zEA^t;AuHuKcCdp$Pb+x|i|kS0kp498;VHr5qDmj~+1Sg}jH|iU`q`6FxIP>QH-iAd
zZLLtj1>j=zLy*bgkLpX6L4|7cLn$~aayDCdb^Q{hGLqtSSLdOs>mK4)w_o)zQ%$P&
z1oS77n#blm^O*w2W;U4@<55#hwBsA{haF2Az3{i@L=IO6=jqvO324A0M<w1XTJt(a
zy41YLCy&*&;75x8*SgDMgT4J8gr@gO>9ZX|cOo~qk<UWjSztK@!XQPYdsS(2FL6T4
zQ~E#z`CihgMiK7bw+w~3y2i`n(eg4qX+ePksUw(uk*o4~+;0+wi;IhG&u%o~>Yt)V
z=_L9L77kSUPM2JmU^{$$UFB9Wy1q1iMtD7pTE)9Fz0#+5C3`(iSFkjnN0VwkY!s6B
zqp(V-3r^=C#sPa_<nCx7!cfnj0$?ulsG>Hfc66OH!@e@1)Od-&@Rd@%8L|oUFy@$1
z6=x%gN*yU7LaK&gz-_-v^X}&0o1{xl372B>>!OmnGO?5|Z)oD43Wy0d-Mto3>E`o}
z+4uva+Ks$yJ{a<?u0(`f{hs0rp$4f-3$GRYj#7fSyWxe?*k9>#X(i^n)ecAP?Dv>`
zUlCJ@Gg5Y|JY1^OgLkx_E`qMg43BgG^wy$>Qptby^?HTTCtA9EG9L<HVeTf&CNdgV
z?~>aWmf8wY6vWHPrqAa{<$kxD1RoLenKTw#^0c5aO$&YKx}39#+-&X1-uUzu$KGo}
z6YWa6iBP}vi;0SNNV&t})Z2}quDXNl?c(F0?d?#ul=@-lCK7|4#$3Z|`>Q3%d1g)*
za-N|KM_O|?X3XOSC51o>ha`0N{eowLt9>W41iB++k{E?^)uLhGqWmiDFH_$qg=8((
zw@M1F&(0#7!c)OOY^UKMES<s+Gr5<O+P_kP7JrhxpSBb(^xbt7fs)T|Ney)?3{Pzp
zkK_P6TL>NU$T80sC3Uh39)43l2U@Md-WVzZ^bm5lBwl9RlT>s!ld3N*J@2?Pjsh~#
z3>qk=HA*XT#57XoXyzY@_e}RIlbF6DPwRf3Z^$34;VSg@C(n(4@zP18P!qJNouNxT
z^sS<vHTW~K=^*&1IMgvhbEIG-dDxD@bjEt!L{3;Tnr|@rlC~WmjLs4fmnfCrh}+Fp
z%NZ6>!z&K%^TlTH=9c0U%!p!j>XF(FNx7S0$(ac2yXc`keM+wWTqiUb%_}OjH9&~=
z$%15%?%_HYedenRuPm*?2aSYzNky*F6(ZYLUdShYi@E(AQYkp!#aU;OB;&5f=UK1C
zrUpkpD!xCNwQ#`Vx!%UEJk?cSw%AnE;?5xbFZB2{lF173wWr`RCG=JVAY2#lY{jS^
zyT*eAf3G!+xl<d1l-TVO7VluGJbxo*=2Igt6H`~41GsBZx5(|IIE~X?9UvRgpdX9M
z32$Mabch@>zpMxr^DpQxkLGhC{!-j+=kd|we#j-*xw~ZLMT)ZF+|MdSjLaxf#(XGm
ze@RqvC!2b9F-x7bLk-hykoO9OFj{}dC5R6#<2Nm~O0?%eQD(fc|8`6V`yfy^P|&Zo
zd;PKes*y668@JSrbH=}f)-!HnemQp8DTwmSALHc2R8d9a5lgxo-BrS~QTMxkQO;G5
zTezB~rgl>=7phwftK_m~wzM;n3@=v<wgD6!Td}jTWp*>>kK=_032e5gpdide?FKbH
zi6jfow?-cjU3;45ovUMHSPJ(wR5s7A;UwmIY53bR=6wq-<!|`akbxmj8g$l;jtH&4
zE$%XuQ|u1T>@Jk#+y_-X=F^%7+@uy%8s8daW`OQ2qI0l<+tb77(ten;MOLbnavz38
zBol7h<^cDm8^OD2bf|9gL=HBCy3Dy8f>Ff>oRkNbt-}!`G{D2%v!$FtGrS65m2bu}
zeXxqIXNBHE;kdB|DJD3B%ee?ep>%-Nn&Auc^2VO<>F~UzLY@I<)xl@C=v9KeLLg>l
zYN{iloU+il0&e)8KRE`2{3bxi)>q2dBSzM+xX|9mvhn@wOeC3g>D|tTiu}>%WikG2
z!Mz;E-~*UmuG-0a0euD2U-rh@5Y#?TAoB;pms>AmOU6%8AHyvU=7QZxv1Ehu)_G1X
zMaz;}@_Y-+_)1_RMbn(Fs68a4>RHT_iXuseXMj?e$q4HeF3wf(8*9xCbCQh~FDJ~-
zgLIT9@$y$FVdki~aH!m_-3AG+c;8yeM2%}=ov+0C=iHx3(I;QmiVg~fA019IEyocL
z>}6Olr1GL49ce^X=yGRR`TKuGa@4<f+#g>qBPh?fA3jSu<*EAqW&482BPEje4mMIM
zjfZH!;`uqc_QBH4|5zR8-P5JGkXW%G?tyJ$>Fj0RP1!!0|7l!4F;3ZCPYum*f)uXe
z_f6Xj01G(*9H)Bb`)chv)yg;Ol*H?W-vX)EF6uuLLcEuBY2YJjFSKq^a-{#^8N>$-
z{}qKnvs!ECB>0ER6z_-77NFA0wK9*-ei*%|RB9x>I!&8tYRSD&Zm5+5f3s#v^2wOP
zs><P>#IF$wu1z5eB#;iy*1Zqre?%BB@gs6yyHov^>i%*O8bNVfnhk~X`dx-lgt6zQ
zZQwWp{O~v0vp8IXJg>^;hNU}2O8J^9KF^8D&W#q*GZissCBU$caE%I8S4PlHAxF29
z0I#~yU=Ac=Quy*`xH0EGEDeN30x8#~#4`txy^96POEI=c)x)AOMbYyy(ke8A9;-uQ
z)rw`#ma1Z<NGd3j(#Sri4;II>ecoD(HBE=~qk$(V%C7UbW*(hCzO*2OzY7#an_tvH
z9KTQFi^MZB*2Qn)37Fs%2-W`lQCgoJNL+qo)Z$22x37}vN3y7)>Ugv%IRYOIB6(`u
zY37xD&*(SOVzb6ol-Sa@w8P7&#A9aJ@kJw3ymHaYkz*wL&hp?$RmbCc>kFlY_KZ@z
z^H^S#Pdr)$v)t;jDThYOsV#@Orpr*-l^H8A*A^ckrt%{SVp4G5O(w7=vhUQ?Dwo+D
zX7H`%aIOED$aNvE0-uji4&2%Tn@Z=8p9^F*u_v#Bd3cxwiJmnOB!}j{n6y}lA%e@L
z1{xkA?i>29^$<h>jP8ru7}$r7V^<D0&n5t`oWJ+Fm9F3(vtdl?3oXLYqBtv*nSHei
z^*?9|-K$n~Cg{9?WBih%IU7En9v|TcY2m%1###4+bK%=r>ceG$VuFpMvs=>8=m_)F
z1zw?>6Wb3${$sD;dUN&o1_2Yu4S@@XNY!D#yeH{p&9VEXlBqGIn9koMu*Lwj?=Id_
zs8dWitMVY-c<m?pv|d*GCPc7fKb<!XW#h4`G~iZ#uH*7NfPRC^Sv9=y7T!m0g{e5t
zinvkfB>dFjzMiVD_j1vJyTlTvrHOnP=o|L#gt}>}a8N_wlwlHBr`%IKrlq)0iSWx+
z_LvMcSPJ=){EZ5@upC;4xlmwh;}zKAwC9>!XzReMnNY0nsGj1rzX`2-LT7bn{3d*s
z?62=FlVWX>VD#eQXtuub(;jZ3RgCupD=zlp(j)eD?+M*ih)C0R@<r|LbC%c!T&#(Q
zl1rYEDg~lVG~c$7>6wz4SMM!A>aUCNR1t!Yjw7f}GMb<wLi90bm$~EQX`$)xYQg*I
zBG;($!36T|p?`TosgCkPHe3u(Ir-QWdByq2K1PkL>b3Y^Kcc5hJ1{mdB?u_y>SU7>
zL$j}^^uZUN^~^5>*RdmI_K#2U)Ea{CXdP<7&y?Ja@*dUfi<EW>LPWrCUt@bB+^y6^
z6ob&#++V+?Hxv(A*4pK8pz*(9X5L`X#s~rinE$#QGe90rSEDZGf5TV>KyJuaM3t}q
zR+|WX4CF86ty;(aC(H+j2;|g+M4pHK$EoRU4DmKCWB&BbKVbq0$RHOfc<`a`Z?Qo}
zcssL?Yu^-4=FY!af}`dWfV*-O^+lHaGSvTLu2cUk2%IQ`;%~eDj0iuvf2ME#uSD=5
zN3RlCaNfU(3q?WIaebUi`KRzK2#}QMU>m0YCf-K@NlCz8`#(zgsWfPB!2d|>3ev^@
zFCvuK|C1Jt55jTT2gkpOrk}X{>v&%yLcaAfbA;P$_km<`ySBL7%gZ#FuQZHFNuk!&
z)t#uf-IVLP-AT0uy#pi@>2n4>u0~4gR;a^qSPRF`FwoHl4$9i-eSCaSadFl6)U_Mz
za@?<`l_%<~wc%h-pH?xZTUI3?^&o#YtPdA4vI3<tRck+GraK98OnH9(yO4;8gzce3
zNhhaT4ZwPU-6$vU?d;pTvpzy{e*QLv`LecWv(ZfV^MO&<z6(JSk-*_pb{RW+`*4%u
z!xnnAYBA53C+CJW-`C$wCv)S?T6Mc#skXS*XgG|2j5h;X8oFb+UhR`>HaR)66&yct
zac_YC9t_?xDEZ7CaNv*?E(@l40}a3o8mSZ(MxwRp6h4ne_v?9M)VFWRHv1ykw`KV5
zzT<H_6~Cp0m5xh)=gZ8)qoL)xm&3HODknSWV!!M-JJ5rvO&c8@y**{;HJDPifSR`I
zag%<wv;b}FcryExULN<m%dd@5$QmCM%jZe6YK_p8HBV5n*<PsZ2RK*R14qw?7}_{o
zrpmNeX=}J&OaFij{zzM(+|yo5tp_5J!UDGGhSd}t$Oq!zqc2|-!f|Ka-?&oH?-hY4
zzr(I9nzf3GiU|~k9;WW;M9a(b1I5au#9+gAf_hk#>uCo}`V&46Kz5DwVKb7SjF)%0
zn<vA0#f1rQs$+~V1G89Xofye?FXnVOr<+iQBEzNE4O{gV9~D)u5PQG%VwAhme3l*#
z0U_S$XklPlSzEIZape)n{}LTdDw<;3Sryuf%VuGc5LMQ=Pi_CWov1w+LoR7>veF`=
zp<nFvbf7KOrWEA7?3fsa&pop@9Y6_KZS}Cb+fIBf{MhJt@JZ~$#m)%ylheV>h#58i
z%VSkYqQ~P|U%H`6ZEp*SCmS>Kq(+^7UxeMfVWRk_PhmRPo(t8czOL`f1DCyCo{Urp
zX8T$qv6)5qo-XC>-S7AEQm>OTBl(|Ikh#sS!q2j-{bkw-0Bhjl;^HWPTCdx67&N9I
zZC+mTFhI={OhZ_z_9eaHdM9CFf1TlaZNNu5^$NX!=7-~^^UFz@R9hmA%^zQda-aR-
z(6)w|$Epj@<9|1779!k~>V&METujKUf4=E-p<=SSzYQ+CRT^`{HfW@<Wy1^sPp4{3
z#yhFb%MTGFO;Xt`Kk=KIn%a%=-oTcE>oVG`34kia;`=Iu=V-Bx!JfBBXC#I7{Im;6
zQc%z*42M-B5Q)&Lv`MD}!oEefD^OL@5Tvg2)tBel;G7UNN}RKLw;QXwjZg-t4-IZN
z$D`lB-mJLETp!Mpwmn^^l97=m$@&%-(~|bqS}mJxkP^cZr`be`W%%lFx!;y!w>f^k
z^t+y!V2&x7Db=I_^+)tem<pJR2E!o?!Tt`aytIwWH$qv0-ulG}#0ucEKK1y#uGLU5
zFsY0q$;^Gh7LV_|v;6w~RJdOrFGjGq9rq1B5ZHKB!w>?#qL7T|$q<qj6JvDfw|j%<
zo`A+Bc62a@To@WL+Ud-OCo<s|HyHcN@VkJ96$a0If%l{d=ohZN*v7D)P-`njBPoWZ
zh9T1L+iQqAXUnu1{9Yl%WbnGBxcHYxhK9!8-U41jYyWxI><0^^yKqoSrH~;zGqgQc
zo;7zY`X8EFCxjB?oWh*oLIoG)?N{^>FhiIQ#!-nt`QQsLdE6`;H@lp&e86j923)Lp
zxPhjCbbTKV*W(6YSiVnE4b%t>p}S6VB(i{#60h+2#TdV}f4cb#vPHjE5SU*F&Fzf3
zHK!2Fk5P#oLH@b-I?s=Hc3lYUu-z$?LNVx2T*9@6r^x*GyWd2DNknGS1>cii5Ry!w
zeqDn)3wa0%4p7F*exrwxJrd7)AK;8ium<WgD=ye%;2rjGR-kUcyuFJHfli<cD;(@H
z4E;t+=}=&;)Jy*BEg_(e(P%h_ywTP&*f6f;tQR*hwPob_>7nOYRe%Yn`G=VBMenBN
zNoe06(_)$uS@wy(`2bvt3V=%Nw07q=_kjn9Cc~r4Be!xTSBoKxc<(3XfF6I^3M&2U
z_P{9LgGIyLPHMW|WMR;=j!J8wAV7~3KYJWCb;tktqOR>}gp2kHUeGW^>Hx~0_|3);
zYU&IpU`uCUU_dE)Q5oQ_Sr%gc6;De`CJ-6Sd8SO8pBeM?hpYanf?o2HRX;~ieQkHH
zBjN^fV7X5rmZyQvz%pv865(kK=>x%v-mKdz+y`TDEe${eij&}Pa6-*@`#Jk{m#l{p
zX0SdALg_WQoNe?#Ad&MVIWO6YVy`Qs#7L#GB~!b&xKO;B(jwI2!b+GW4qlp%A{P3@
zm{47T7e;Pr(dVy>)$H<Ka!QA4b=pSzcv$VcF0-qWes~#ByuFf^hUXT`)YpGn*IYUy
z9xMeg8!`_)Tf3h_2g|<x9xKiC70%?f?Qx0j0KQw^!U(Fr%9qs!`@Fr?jmT#dJ6TmB
zJgN=bin!y^)8vW`F_c1G?1X(y1dB7ytUqhXQ@lQ0=xNuBLQ4eCQMW!@D72RPoEX_v
zOs{MqyX;!H{rX0ZkL*eyZSOi?GbGgur};&75_~P~9Fb5tuPe5meF#XzX3Puj=tkx0
zCi;L&A(LUDC#ZR#yu<5%7>3OpCMMbzJk(u8zCbgHx!-AzAQV=}ZNA)CLzN4hz{gMc
zC5QJ3az0uIoD4cDXSqQr89|d^6cHS3Huxfms_OnV*EYToUT4&s&4Ec3Ew^s4Qni{v
zS}M}Jp26I}xr#n9HG+@bGWS(JDAzOHgw3@85L*M=p060t&UIW=Y1|^k_628nnf5Ef
zBFL?25U;+_l;&GF=eE`;({y4lB`Y3_M>U#vG5xU>8YyKd8PiTlT5mT(DI}LC=|1eX
zqXqg$4kp#ag?7gb;y}IT@d&2riK!%K8;>kf9#yOCspWY#QxU0a4y=b+Lepcc*hbOQ
zJbK7dx+aKb@#l~ONUXb5cN-Z#RLs^f%|<tGjh1urzM0MW(+s!tK3phirwW3@9gu-4
zlFC9moH0V>X_^^z@Zt=?dsVpp)Poi25$0(`8*u9`Mg1Cy2IFI?)~%)~s+&E$Ixf!-
zCv6NDP-F&r4}QA*vH(kzA~SYL6Ls4n4r6kxhCqzD#RdXWn$_v3a70FP+v?G-DodAl
zB}}u*!AfK-x<eE+-#ZHZ2pQ)t(1;O(ss3-l>YvO@8+wBS7p>ct4>93naM^@Jmk5QC
zW4y}oqYgw4oE&&vFW*a^h_U#J`O60Ay5TjqfnHovw3Pm6Y)`#z7DaxaoSXv<?O-*6
z<t$7hgeih?Ef%a?m`V(YtAlP3v*B%{uuf_%7e8@ZJZvHb@^a}0#|Mb@w)ku_kMZaa
zMpsy4t90?bJlc2FlB~n&!XB43pMRN`hI=Am!+^kdT5AWtFnjX5UCxnA#EIB8+}5Xr
z43?+8+Z2V{C(#1Eh)!59zO?ZFb}b1&v`S@3>v8yiVfV=JUd7F`qsa98+>A2;3W(S$
zp27`Jts3ZuNWS6Wy6L+RT<;f^r6kE7io@B4bdy?C8K^GST80B?8OC9b%3;W3G*4j;
zeth*q(XCr{N@eE8-=5pp?ZvfbxjFqIg!Hu^U|4~VoZ(_cX#Mdabm1T+;*zjv*!3f4
zcf#`NO3g5rwRI5F?9H4FKE%;c-71@#zS_~+NH-FMP4ye>qok^2X5*B$RI5hua=6yK
zgH1T`Qx!eJ&yO8zoIQ5DPz^;lXb%w|(tJrbY>1_GOK)C{F=gQSd$4xQF_{y}IU}Li
zv{+Z$DjQw(DF5l;3*@pgE&hn?x<^`hpH5D>K4i6bsc2!iBnPU2SyT9j9PlONhvq1y
ziMs23%pO}|@AYNWT_mzz=->{vO{6qBdU{x3L~U53>(0nVcF%yqu3uw}PolK0Z%2c-
zrr2PhNl|vcEa#`hYCN{wkHFl)U~H|Zs8EzZwx6XO`op4TneCYr9Of@G0O;R>{j@B#
ziDX?{W-vv%8UJps0fWO+2EkTj(cad`-%#%p5UE|ZaIOdc$y02to<yL-MMH|xI`Fq`
z<PGH>2?m{aG6E+m{1?3Y&_Ud|X~yO95A&|MfeP`kmgXS&D-cI1h$RV>CkImh*u6yH
ztE2)Qdv5lfD1U};RJ-j*Z{Lgh6zP?JkoOh@r_!sbXc57Gg^8d6F=yYj!@1F4soQTr
zh1{>C*$Dr6OOn}WfNIB6nj6b5^jGRu5X4U2?D&(C{5Hagd^W#;K?7}B)0_Vx=u=)$
zA+79`cqqS-<NsR~LQVH9FP*PjJKADv`Tf;}G!}$BMdan4+sMFxZA2u2G$lO2-}VKA
zn|cLmq=l?OzCXqlNM~uFMoNDN_?ISSaY13`e$)^DczjT8KpV0gve*7V7ihDJfaOmQ
z1VZ6q>|Ytg+QmUS4e^Eft9k*58bOe=fGxjL=5I$J0;dEu=Km7Vhs$L`*6@|*rfJKT
ztZS`%tAS*J(M=|^7@u0TcrCt|W5O!4ZkBtKS<n_H#y|ih7st>M%th^CqW0`bbn4hH
z9nB41!YbRbV+O$tmC~!a@Mxe>$$P_mv~i*-7XldW*hz!^$8e_457x6ROH*`QPQz2C
z3ml)Ucxv*RIgI1Gh1rU2-qZ)lBv>SjJjj1~_^~FyX{`gZhl)mJs(N?6xZ`o&cMZ9*
zyR5+Y5_S+vl&&T`cu}R4awF(-wUtrzDnX$f|A;e&_+(U_;hS4+w9`oE_H^bf$Jn*S
zvV!yxDuWd6Y~ped^P8q8QRb1mz^{UK56MqkiQx}hH&PF2mh=P*s$bwE2lBYAWM;_e
z2bUgR^Owd=74sO^XqBW6aC$5b;@Z!O%YE78;<%G(8C}|NtJ%-up{WyKBg2nwz`d5p
zB}g>ZaqgS*WU?QjSFPR5sxo`PK(X748a@9JMm}1pG#<YFCAM);o}V^WzNseW*)oND
zY#wRl$-|GuR7Jb@%8WG9>mleVZi%rp^Rdw4J%2*___vxjVkX2_LJ$UiqkD;77V%4u
zAM6{QQ;qDLGHZA0%XgD3rpJz&=^nZ_EHg8mMo0}R?VM_=4|$TA78!vvoU<>47;Xp6
zPt*5@+HQ78^F^7Vgi0q48T8hNGih<`)}s-BI-nNvDHW1&X#Xn__w*@7B?v`@`4ZD_
z_o&P7hPB8T*L5d8eOw(M##7A%bUy|_L1T@Zw8-$JSS?g5RbXLGmn%FZM2CM@R3J6R
z-WQNmvpj3O@)p9Q$Tu;?Ulx02Y8J*4_^zv=ODw1r4(>=Sr(56D)Q2G3vG}1!AlG1P
z3wPXBsm*Dp`6*MrsWzsTt5%x&lWqVtSP5e;a4VTn<)n_l0rs4YYlUrmeblP4M|6ml
zv{77Ez`J-Z-r^X#lYxhJZVC<#p5-ZRwJn{6p1un%_>gTx0*jNo8b9nLS!W?*o~A>I
z8WnB4J#H0X7Ad!V#)ZTIQ?;-22>tORQ=^;t-594|j!z}sSo`;eN<5(5$UF3~H4FB~
zU;$Mz9dCgs_2LwkH}PQUa0ecNmEC~iius3N>xq1YJ7`Gm!P^x$J0d#y8FB)}_4y@O
zog%4E^_wf>H;7N;6Qq0+z@|2MwLT=AherVwHU0Jj3iL88Yk*4dbh?Y<%}ZD6nCA!i
zC)(XiL-dH{P?xIv4VqsQ9zZDT(c014HNS%k8A;V8fO-wW&;SUy`^X!+GUpRVo80P9
zRDe^I(YtfMY}Rs<+tM;xyESFE*vZYN%&XZHga2X1Onsj5%?Tdm=kO2PoL4$WJaI;i
z4Xz4E*z*NB?p5wh(<PUR#AtZ3GIEM>0zWLJ)l7M^W}d?Lajd)ZuU6)NZ0npyNynr`
zla38*SdF&h-W=wTZcTjElyDJ*+@FrcmENP0@i@r`PDmx!owC%*5l6H>9H{WCD$Jna
zU}I2kPEXz~f5A6g_y$IxY5s_uf|SXxP>MaTsdZ}`zj*%+Z-%i~1FiE7$+3x1X<y?t
znz<9@>t`K5g~Jn`w4LVK7A=>)dLYU^er6k;I3HcBHh|CiGt%7;M8--R^B7aBHiox6
zZUeB%KkCw(%Q6(2$csc*8@=MRo$X}0w$M|Zakh`2y%etPfk$(;EnjvJ9RGO#5x_Ig
zZLY&Y6LPo_`<>8rzH!xE8a+Cy0Zo)jzXNxQh<0^(;-(t_c}cKT3eJTfBYC#^Bd+1T
zuN1_%@%-NM200boBCVr-2;R_MJZrVdTO3;RYc79`1)(?ipT?pSsDB*QDkSEukNDY~
z_e#$i8v0{3f7gZnx-WQGICS9D<v4T9O=7$&SG&DjmFdjeTX}!nwZ|2R8kuIEK1YE-
z-s~CN%<kp4WyaB?a>X)};~3$%wD~v^G78$4GRDN=@Wph4wu-P_KhhLoiV$fVyOW@?
zk2U&4>F6!&=ceiI7bNRGt$CNK$k^Y|x+c+X3}x(f#kM|l+vnJ15aG&}s)Jn(xSMzU
zq3FRcT*hd4E(TnM)ogTTo#i^)Z>d@|Z!2cqIO-HkKkSL;vzp2G!5esY6z?~u*76XA
zLcfc=(#nDEb)hgfytoz2%lk1ghQ^$c`iD-@bsVg8^QzOk>7~~Zbn3MSSs^FQHnO7O
zQg5oi@U|ja5|XO3@SzZhz@9Tw3uqptyBvH<J6e@KIC334dYE=Yk~Ap?M()&WS(2;s
zt~X5&HLJD6d$1~1Qy|3rc;@V=(4^3F!SS`oq#s*63T84P_>6k(!!~OkcCtEsao7Dl
z_EV~=x$|Ob99Q7Y+4;Jrp_f_0<E~s;?z0zw+v!bl<%QC|(d}>B$^y#WNc<`6xFoEu
z&^i^v2ypv>aJDI&p5Lk(q0TjkMj_3;wVDij&mue#Z!Jb(Lyb~ipXR7mw8c7f`gJI|
zCT*Y6wB2iX1%<?G`o?SM6JlY>C|ATF$FND^6n9SX#3jw1U~}%-8&hg1-4fPZ`@W7C
zM)qldD49mXf_YnMbkHa+$?U;|l?z7RSy}kB{g=7E=#;Ry>{;<2NiyBzJLqwj>RF6=
zC#D<IHKa`g1zcn3*c*oHPmacG<1L10SEEL$=0-c{Npr&lB`Jeyn1V;8E$oK%=WTfm
zw2J6Mj|s$#@S6g~=B`cyKuE2vE*v$TI-PWGfF}yZSx2W-%r1%Ckz=&?E0}l9J*7(W
zFZ|TZ*Mp;}2T6AszYGjoh>T@1rEo4l03|~$M~Fe1k@9Al0JEE04fUCZAXN1iYE>i4
zQgQ5Z15J$U8N1i7rR)$<9ZrogKPnNHIxY=lm^L1!e<P?B--j+P><A4|Q6wW!bxNTa
z=3z9gw-?8U``B;8CqL8y1;-zqBBr<8G+mmlY~T(w=l4*Eo2L_m-u0=bb&KYFmCC>p
z@mBJ-6prJ1(6}HE#l5jEjBPU%&f3I3iJO78dyPV>{lktEuX?|C3;#jA<fphk7yNtz
zML;KtHY|mXKVuj@M&<ln#Njm?m(!41K_Zr8r9zsk`HXS5YfYVc6)?($yIfOz4jk2e
zzbME~-F5<ldM$;)6mOrISsCl(WFDt)f1q3+0=0`ztGUOW?dYoc?nSpud!?dIzwSPN
zxLMWmR^peTTM8vH6>*Tv<<6gL?0aX|3aq-LfW%GgWfQsyJ7Jj1h8`L&m~UXJ_jtYR
zxf4ug{%O;Y(vgt_9%wf40TNQu(6kE@*4C6AHe}XIou)4Bcp0^#rNr^kuXk6M^Ik$K
z!o~hr&9p?%_0!mlNI4Nkc@6zyr~dU|nYrP&UIDf1YKn|7#jz8&3kk{$6(Da5h%jey
zvn!Ih9jWe{!H-5NuhOm}a$IMfE?5}%za!GIGB+87%xS?8w2sn|hSy<2EHPOSvS<jQ
z8|^uLEWJ*!ioEQH?h30LyTWS@m<!M;rVt6(wYyh-ErFVM=qNK8<x9FR?r}QQGpc8S
z8*u1ED{d_=!I(*I5q^1ma*$*Dq!SJk5zE_%@RrAkRTq{}AZ7}yg#yY5aye&><mn8&
z?69-sVOdLW-#6T@%2P{ZS7m3uHvNNPu%g95&5cQ*g&2><{sjzDA^QvelGc=zu41p&
zN^?U4ROl}P$$A5xiJS(Bnv(oPU$Go%I9JCgm1q`i0rB~+(&$iH3B`6f|F}0a5UUmG
zQgTV1JCJ-K<`{oOW96H)w$ws<rXg0>(<G+p<V1X(`4Wj9iCYr@p~NXeD-zVt0!wUG
zl*R$`r}XFD0bNo{JM@~RnYlxy?_tY$(3_kpLe8(K#aw$6!;lP*i*K1m<@*V&-{R=`
zqr}9lojrP9(RX3QORT1Un;+sYi-Dm;w7u5l$13h*m3>GCZMZ`LdX4k4FyPMg0CW-T
z)kzOOb4vBu&X>oO<jBHoT&-UOrZDP=<7mv7<K-1~Ou~RamV9w+dMajYLr%*x>3#mx
zlIP6w8ZSe^LdgH&1L{OjV^9&deT(%hW0Scb)8U@WLz1W6;x3=j<DBNY7k>%c#eONm
zb)?kP^4qm-|F!C|F>fcjFlF2UwKbhOFApy5I*r2Hm!OvLgNg%QB^D>;SI0XeS2*r6
zzk2pIN`9U;ed(&`_H@}qgF4@1iNw(otFOwJnG&0F&c`#oxz}hJ#cG+sdOG!5DRkGT
zfc0HhLZyk=qM(HuEyoqo2Ofo+_a8eG+miVsmseHnn}1RZ2!Eoc_J<N;<x#J9(FjHd
z+dJ(p&dAtoPaNr<_wQZflUGxU)l)xA;!rl9s|Gw%vN3vk5j6E=mi?D`o(0<}V*(!`
z(MA7RnI@A(2Qj4L*Iu@N!AR@piZTv5&999}|2Y7l5CB>nRm`vWy;A>^;Jjx+MAjnG
z^X1>fio~GxTXZvve}I;3jTJ;yWuGfZ{(@?hfa1^f+W?%!e_0S91;R9Qg<`S4H2hOU
z$8(dR!Z%@-e_`4i>M_y#X*}W5=Kh4oZtJfAYnULJp7c^U#Qsv<sWzyR&)m*<|D4FV
zg$9Y#mPCOV^Oq7I6G1M7mr;Dtf6f4Tf*^5{AveVDAL@Jo9q`#}v+s+J{f}z?qY7;h
zbY6y<ZV>&Y*mf__g8Ti+lI{N#&t1aCXnSX%%)EBUoEdYl($XzwcaE{myI=5^z6C5%
zlWHy$UChqNI?N3ZO+;$ld8~838*Rre(sI&CN;f=sRa)JE*Im)OY<Rew01d6irVVvx
z_EX6WonWXwJ$+jm`oLejRH3bvStG`G>)3F}o3>x<HP*B`;72&()Cv?_Musg+9a3<Q
zw-guMDm3Pg$|ecwf7BU8g@cEWF)qt|=doB@Tn{<(YiEMbW?cJa_*gRcqMbv0n0S51
zLDQqfGj;O)rryBtKzz{{)?tO_cm)a7yLVAbzV3C76AI<ok^GZ(&Moxwi>r)6VyVsv
z{*kvz5Tvi-u;sq)2b<@)lPq2n#$8v8820&eoiEf~Y&GDHC4wJql9SV@<LtIf>?e53
z05~q-L$`7<`5E=9^fg|)tTAkEP4Q_C2fgHAU%WwiRO<+Wl^!GAQ;kViKF@?`Tbihp
zd=V|56@|IJ*@g7@`o`<l5IBnH^3GW~(ePIvSu=++qE)d>W7lTTIB+siQT4~1O5Z+k
zzVL~2aL(Irrq!P}upjxM1WcaI_EiwqcCT2p<+<3_AZ5#2aY=6WSnN5U)MtmQ?lE7b
ze<%N<V<wW!^j08Iz<h3G0`XlJ=Ps;r6|)~C0#29J4;md$k`z!a>JGWL(!6J_GRQi7
z!0jZ;5UEM3$hj%C<(TZYD#koxpbu&#J}LN<;fu!~P=-b6rlW0*vK#kz#IZ0tm!ygg
zOwMMIR!DVjC(O3S#jD@+w=wX__g)^*B1t`b-l1J3nvLKV$C*Kj2e#dcZ=|xKJeo-k
z4JXX)!n)j9$9^{jK;8)_60RsC(F_U+`5HRBSe=($$nc@?6E++Fca-pxm%Be`UGQGt
zP6PXwtw*A!n_|8zr(yw@byTreL*KjCEgThnJlIMe114n$>Ryp^*Hz2+Y1P$660^OQ
zpA{E8CxJV#OKi|M&R`%TGpb&cWYB1n;_B;@I53LdaTjQDwR^hNJs+&QNdF40juyLp
z>872a;i&bI&5Q_1i%sdiCKMC4H%O7;vDxmM>1+BMO(v21>hO4HPc>?JMcnEz_{3$H
zNGxKn<$7Jaf&SLqV@&G(%+%*t&R13XAVAd>W4L?pUl-|n+??L4WTu)=Bb+EH;j!I@
z>X?&$djW?8T+n<#IPp))6|vYrpje+bAB|Uj_WbIJwa*QN)I*az3KtUE7P<QJ!6I8z
z0YG{Iew*o;)m+mO6d~~`7It#gGyLS%ZX9PmHI15KB&i63L%WpQ+~2=o?a^qR`c8j{
zz`Dth_t%V*j{)9oro~=WbuqS*+|t~fG&%+>!Qjvfbe4)rkRsi-cg$6(702gAPEAbX
zlI3eTk=QGd97*V)Vc#y&&e6`BId64^D<foI!ag>dE+|r#w0Ol5oY;9NJfLD53dN33
z9)2$!{i;Qao;j@f@q@Th+4kwNrDQs8@y+@1QKFbIWKaf2Oak$Z7LN#D^MM`QXQ{J+
zCB@ulBrgjVy^8{K%E2(0QdY#m#J0QTdCX2kkwT%vDlctvp+>U)CLB_D$SO=l?#sO&
zgYTQ9ljnJp>sp_4w({#e9x`LM*M}(kv#+>WdL1&WR?*hmDWUSVYpn?8```DKl}0;D
z+ddPY&N9)~jJfW<GM(n>{6yiI{HaC1(mnS@SI1u2(&^c^VgcZa|D7<Q&Z<R>U{V{q
zJmA17AGhTP9ws{aep#&kPU1*hD!qbr{$^qf=YZF5^92LWV4GX%n7YwF&vkyECAqA~
z7cKCbMRU#Zcz-0O$oI|lMIqe;5sR>u91^|~bQ!mOFjXJ_?Px&xJ+NE;yJaW^ldTC7
zoHf=CkG3+5Q$=#()+ye`!rg#9dG&~+RZw*L32a@c>BQWTOOcHLkj>7l?7H_gSD~}0
zYSSd~b1%|iq2#GoBE9X1;ngVF#d4deb;zrZLg1A#Vti76uiZ+ymPn9}s^_#cOx0p&
za=Nj8LUb(UA}Z2g`SB4eBAYe|PJsADzfHQI<&2GVuyUq~oHgd+RJ&H*vFDuZ6DtNP
z-aF>RQksjRLgxn#d#lCgu3W3djauTyH>)h!(RYS^<gV6l+RSv0^s<L(Ai@@Ff@375
zv9sEo5(aQVr~Iagt~c*+DN?u||9i;L8_FzIV6q%wN;p5{l59y;l-_r3H)U_U%CKnA
z%AaUCPnUYdjY6y!OqJH)9-GEopQ>Y6QBsQ7Sf#j#MoyHKVK2U*nZ7`OLB@vCHJ|?y
zM8H5;Dmh=yT1bg3ZH&D^Cm%0pP+?QcU^t5eXV<H5WTH1!BhQy0RFLfY@;N3tUElHZ
z4y*8D2fX8+`?6J#r;mVhO-YaIcF`Tp)<FRIMLqBb%4}iZl^e(`^;qPr{K4#~S3%yj
z+nPSSdSYIe{6cnYM5L71smp!My+KUN&NaA^vd`22FN?*;Q~szomg6G-C?kEw@Rbf{
z2;APF3P0W-WBfe3*PddZ>49eTnO^-GKZ=2sZS!3I0kdxF^)K6FiogfuED`>hwu`CJ
z&>7)wnCtTPe)}<=Vv3fQOt>XJpf@$-M-_vowjq>prjzaYoi$C`QRIA#`n_{lVx2KT
ztVhr!89mq1lx-r>riDfq403Al_!}!OvBQj!FWnS@K2c%-q(qCQuO}j$qSwbVl3N}l
zGcU(&>>NW&_|4}}A4u8S+)mZH4&}G6+RA{9MQVk`ZM|Nd$O)KbINeqwowzA=b<#Z3
zfY2kL^ml!baz>_^T_iF=TXzPf?7ChPO6J{Sjerf=e35#bu&a5--xv-eCMT7o;OA5f
z$RRy=9U`DYAYjo$nCdiu%TF73f>FkvJzj&9*0$deIg$X!!Jcgl!<m#qAL+p(iG1o-
z;L0U5JqiCB?mT1{k{RRqx80Tjd&m_>(&Ruxba-p$ni(-_R;6T-5XAr3aVYLm*-QMv
zyXA7kozqRs*`<mD10~+AHiEGMA<~OY)QZpeJMChl@)~j>jgXye?6^6Z$2jz;q$?>~
z$>3}lK6RvYD!KLEQ#xyTYVml^nQ0qstbO2Bw8)iEv6+?jH&$CLVn^H?d=}v9B;Tjn
z23N76D*Ce#gepqDmw|ydT83CLVNvdvrPl#D&rq7;9y_7h!)C{KjkI3bNn`o>FR45t
zy@>m|!dp8n;zp);ZN10!r(trcjtQ5-Ok-8EnZQpNAHd$n1ZB(!lg@#<TewY+7b@W0
zS!mxh@{5Z=Yy@)Agh)#YTF@mj6oxjRYw$pSR}9yNq|C{zB0bJ{Uk&H#FT>A!4CPj@
zRiEbjXWqp`99$<aA4p&*wE6dMf#1S$mxQ|do}&h2n)Af#L_-f=VKJ<yV`fkku?{^I
z8uP^=v2x>9gwEVp7f740OX+$BZdrIJ;UL{DU20)hguK#!aE?wLC7>dFybRJfJzYG%
zyv!W2VpfhM*ut~qRd=d?YCYAAoE}xz%CLIg$i|o4a<jngQ%{fE7vgTX@I^K1H>yiB
zte;|@%_zF3P<g)EQD)kUu5+wQXThHS<~KbJccvz@yt_Sg%?}PKtmWUU3e|XK(TIz9
zUDK%~0qgC=nr8lek!b!QrB$b79%GLz{ZN#FuxycGn}d1w@Q5)YzZc=~BhRn>lRjLO
z@0UmG$bbJY0P7Rcn6wsU<SJ8bv$A7>@;pZ$*Atwkv&W9A#B8m`#%BVaN5v#4sE=YT
zQ6i{sdFz*wM!p=k6|Qd1E#gMdnY^|}sHntO==W1C<*KCMJ&)iikS_nKxxmrXZf221
z{o_4)CZ+H8Rve($Lr;7e-PMqPX@(7^^l8n*1!zOi#=|pRaLDn4F#MNoZ<Zn;_2tvU
z98n<;Hjjf>?~Tr7!!djI4a?~HU=i2zY59-yMml@M`Ii^Ko&9nkwOV7f6>-~s1SjkW
zZub1CQ;~`Is@4sF`&zt1buns@B^22r#6Qd#=P%AE1c9CNt~6aRFj*c;AjojgDu)pi
zN<O5A$ro`w5y)72*oi*@Aco!kt}ptaMYp$lJfzi0b?gau{Mo|@TJi%OTGEMJzvRQI
z%`F}E{Fiy8-+@4ea?0Vt=r3ht9sm5t1-$lJ(SJea|Alyt=iiARdNV2CYOc`!t@aeE
zPd&$ri=JLO?C9?9uG)tYtG|+g)@0Mc5~n;o0y+5pfiZhf9X$Db@c8~_bIS#SG3`v^
zh{(TncuWJqSf&h7&~K~;+3&5=AQ+o94&MB;L5B#OpArOPK(zk#e_*WaC%|4|Z`}S>
zUi;Wj7`ubAyZwh14?wK=zs2Jt=C~ot8#I1BGkAjQ#A%yrw3Ae6{W7;pyZL*aF)bL%
zbKxS8r)`75cXn`YJj~)k^UKN9`A<IUeO^_s^c)kcn=S=Bqurg>#s7!TRsz+@+^n3b
zB-E9T4MQXFV->k$w~jKOqauMNG2P!xNAHo`S=0%h4l#jl1XBp0CC6&Rk9Cz!&N0o;
zPwsm^DjU+KYQhUV-|-H`1q4D3sX{g?OhJ$Rs&%`qq)u;b;&6+lj3#MbP2<eL!=v39
zSMv1`)4<?J{E*Dv$sa`10G-0yn{S9ojy*Y6NRLN9^pHGvZm}*+Y}#^%!)MWi=p0&+
z7aV82>nqY8xc)9QL7$s^$O8~wNvRPdXfyM@w4RldQ*dX8r7Nzoz4(9#!MDC%JZ$jY
zU`xzXFnW>V7CJHah3YU6Nh|t!{YpTh@#3xL6Q0s%$=@f&Hsjl!C1)gMWux5Nrk>1n
zm8>$_U+<5eYMQ^SI4I|p4xTG%o6@5%ooigEDMV2>(9qkv-C?$+TX*lIvTKu-EwOxV
zbz7s}{NZYRJ;8K^lxq}6B_x=!(o`fOJFim>HM)uC5KuIqEa(QJG6XK@VHsf%0_3r;
zC0fhGVYX&aKE%kAfh?R$F%v2z4ZA@9pa2}@JIxb!N^wy<`iojdsqOKhUI{HvAC2cF
z7N5lG@>{>NCrITX{md7Viy2Gyww>%w+yQNwBN>K5_Skl=|8^-)A)THGVQ~<71wC^q
z9cSMA6)$@TxK>-O<MAiNd#TpUH(QUBEvZI8`d3NanUzwRV<~A@P7B=|V|N>UzIUbK
zY83WeSf%gaihArWBP+k#vkIy<n55r(i%D9NB9e3geziX^t^aBOml-nzU9FsVFF5UL
zwT_&fL7N1ZHOh^FOX|MX(iBfk#*<OmQ&Y2Zd-OskdIgS=>Ho0z)<Jc2@77>Kh!7lt
zySuxS;O_43?jC}Ba1L+|!QI_MaCdiicb}6td4I`wYwG?pHMeHI`l`CRD5|@+^zOaa
zde+*{aXPXGT<yOPu^Lmo!sayhe~34Mi4kk}NZ$8scJymvUuScGG42ixH9Yu!WZw?(
zgB+^hTDnzs#$mS{g5Mhx#!coHrmsQneCTSw?ICjrpJ{Sc<l9BUBPy&tj*Z$XVQj@+
z;S8ENK%f4!mMq*CnPup9WYL{vKzQo=L;fW%@iNW4>60Hzm?^o+&RY@^A_eV<1`H0e
zExJhLO~0XEg1!&oXVt+JpTon4%BV$cZEeZzaH0KdrAku9EC-8_h{&&{sKpM>m2N&2
zx3o>RhJ0?%X^EmTPHU=fN*A6dBxZ62nwrwJe-w(qGg1Xi-8OhucNjO9u~Q64$1PO5
zi1JT}A<eCuLG5y856G^Vii26xSK4B6Al3-4wD$e{Ez)RN3k4sTHX+2=EW4LOzJ1e&
zmMj91(rjOem=dM!o#5#?t&^?yh~VZhh2#MD%r60RJf)noWS0-KHzCgZa0~AMH=uoM
z?R#O4W|E|pJ#YXTXk5CNwpR>my1Rzn;7g2*Cc$zs3*YrNX(jvNyX?wdX^&G*q{`T8
zsE7vzg^P~}`^m^+Oz#{TPU6jtj4ykv2rr1HzxK#s2#-5Mp(Kr5Yc08VU^7yOrv5en
zX_j6Rx8Ab}^36@ek@FHV{I8iVQU_u-;3&~u>v%??+46Bnvrey3(_xE#+;HK0$=T3B
zXAGBJmj9c#y*3ukrq~9-nr!ahID9sDAB~3IcUN%5Sm760^X?O`lSrE4QXCIaG-4le
zCM0{?pryQi>tpAv<GA4hwR;(P-u#HqHH_#tN0?FGTsL6X8d+?pcwLj@DL8!Pew+f{
zD(4N{3}3=gq(<#AAEfg|ws>l=8oE+tXugAaTUq(``s?d`mv;%9$Wb|1#?P|GD*>(7
zp@6pZYOU8#9PRFf4pcfnuqG0XIa`*e4(YX(Ot!mkePy7eA!#&}^GZw`7nydM-OkR_
zHt$LH2k;gqWwcqeYYrq>Cr{GWk6c>pSlc|P90{qJCxWF?u@`GIspqQZJwJo!v}w_~
z%2K4=iz;b;cbMqPFfoD_pY)s%dxALw95J+-F`WpH3#-SZ@_M{xy;rHFl%%qWWTe}3
zW&#nS3otYvOfrs=`{uO7NF4{&W1Kbe6QFrQq&jTfky6l+I<PGlmtKM4GTavWGyW2z
zQaf~VUM7^WP9GdBoMYgkQNj4$aj6$Y&zw!RK2tjhT?aGm6B%*OYS9<%*}CcIMfmhx
z^LfWx+^fNi$upoidjFMq@JfgwcuCR_<n#_Xn3#D}*Di1|JsoNV2T#)Um9$6Mhv4Bp
zW1K{l2Y_eVwKxY1*=x}z_u<G+1JJoL=+x<DK<3xlAFnc-A<l{}1PFrzgUi%(nmKkU
zK9-Ax01N2NpzQt4qK{hH3YO!@W=C$n<Hfw<x~2ofZD~ee!{fnJ3!Z8au1>3VmGak2
z1XQF9{em7>rqd@2E#;t<gKX)9Qq;KM8H0o%VUL4Cz{2q`2WiNi)*Ry;;=I}BN7p7@
zSkUJgW`<<BSDi<*MWUAa?{1cYu1}%{8!s1axAS->Zu+AXxg=Y!-<tp${n#d{pvpNO
zL9Lj^<MC+Dqxn5|rVnHTLj&gHMRu<oZmyw-48OQ1%P5{hwaqpwIrw%nD){(non43^
zm9|n&9ou)XrcUK%z8~Rt+ky__dPG{BBB1_2(4O(K@#UDpt8eW}afI}DZSX#E#+1yX
z&Z5&b_UizFz5%MH6rCX*5>aYSp~bD2FMaO{OZj~cZPl7#s8N4Ksc&$67aM9Xtry?#
zEQJkyRdBCyi1ZmMusZ87agfY76xEUreBt4=g@nQPt+MI*oYAEDs8~J8Kgopo<yMZJ
zfYI&M<JSGGT6zNfSL_Mh3C3P6?~rrxrC_PTv&~%iuerI;gvVfFG+P^cMB^^XJKoGb
zJVtUNj2Wv263S<%rlgFM+CvHSjqYW2iH){C&UNTFHcI-K_+3Bq$7?Y)yoU-+bwTE_
zx;fF0q+mg*n8!qx&4aD`vRvk!bVn?=*CnKzBC_At+iGnxDBOOiyVW{Po@iSyqW&Yh
zLE3I_edUBZAhHOC&CYm3?UVrCv*{eJxD*?P$u=yNT4>quN__5RVh2%vg=@QXtfs$?
z=QjK?366fo!KAC??|{9x*owuX2eKP1nUfSbi+AuqZq9TpMi^V3fN@zk#)wkRbIXs1
zYKM}ONha+d8bcTa!(O+A3nydSTU;pRVNRO~6a&LwAAkzPRm;r1$@4mtM67o028xC`
z#+!Xye6-Q<j_WS$Rnq(8VzgYd<%FS}mzEOWuDDOngRVyWL5pXlwb%siTI!vcK~qa>
zTDBuo74lxDWVNZq11<LSenc?puLC7`oNw9dpZx&#%lFGE6;p$mhOUW_4xSkg3SdH%
z%@$G+z%|@U@eK9$N@8m-#$DYR#0>3H_w8`oHoW*Xrdfro?5W_~Fp+2jzfG>)>sH;7
zH?68;7q2j8dk~NHj)VT=Cy;<dCH0~Va=3!hXFZfSoWwC;b+#Kl7I0ZkxdCw(z<t|U
zBU#<k?w`K`Fr|p{f3-IIupkSO0z=7WT$#aJu4Am!6$QCjwxSEWey(k7GuiRY850fK
z*ezMaewJx`Bf7r}VCig;DvJMJ@wIvJg!-nESFz4=Elar8^KI%%5v60zADHaR=l3Gj
zC>A%Zpnp?tjG`rfK%-IX3_5J1--C_~cW4e1`E@R|TH_BVj?TZ*sjXZ?#$1>MrqQY9
zu6l_WCT&Hhjy5)naTg3?Wv)1;OSJ7m_}lye{NIuxAH;0k@ls`_$SwcUP>5~y!8Sc^
zhHapW)E{BTNf>Ou8<IW$^aqgt4_$|!M_b}}bF$h{2UGg-Pld=}eCz7iTkEGe-4Ys>
z!5+ImEdvMB{69a6#cIlzB4!=<|6wVj-;u%8MaEF|@8-%9{d6iq5^?=udoPhr1i{<|
z86)8jO#xdU-+`@<m~B1Me|QRbKj%-wt6<>fpKjrYVEF{@D`ENy<Uc$L|D_DL6rO0k
zzeKIC{1HFBkBH&_r;7i-=*4$ujv1u=HeimJd=TmNm(LhVMz?Px+PnQTu5>Ga67D~H
z`@phiESMJi3}K1<^(A==fQOb%PUtI={}_f}K7*4N?xvl0$^98`pO=4XlqvaZe+}&K
zd_QUNc9Y%2pW(K`_ESPNE?}4aGulpMeoCkuHrOnGv3A&>66$}g9zT%VERT>GR={uL
zis>F;{yL!BaK23uP-~QSz?ZyRW7eG{TJLI0=H}Xk#9>^>P$Kii(HxOtcv#(x3T1b)
z0gyUgTinFp0wm6ky8xR>w-yHPH=+*TN<Q8Z_}br=StH>s%8uEe8TMZJoi&2!CK%LE
zk!NMQuC1w{q_D*7-6J0=?9z&sym~mbwpf_iWrq%zwHvA}2|3(^DlDfz0-B9g0PdhJ
z@5Npoqv=&<fRTkmXRvilOgzzY$pXQ3DodH94*84&vA`0rR+|)V2R~x}ZU23%jqQ{L
z?h=0qUv|(>Pi~gs7H7X7#J<uD9_97_>Z0A4SK{g$n8e^w@Bi$ND$hsE&w3yeP4_%Q
z2?p+4>Pb;{&2v5L%TKFKHBKu>3-LsaVv2sUZq8fp&E^R|k;3m<Zh03CxjeHD7UyJZ
zFHhbtI<Pk@V*Hzq@CDQZ2c+kZb_}Es<Wg9ZiGI7YKh2eaj-~`I5&Lw9$s%>xV_AA$
z3a#4B?%6|WbJg)xR+zLv#jkTTq#3^XKI{2B2c1ZGld`sOfgoINmte;T3w^<f)o^UU
zOes*4zATd?$_F#(bw7^5Jw|!GzDfn;>xtMx5yyDk;tZgZCOp3R+gdAveWWPym?bR#
zsjQDc&BBn}@>)5)c~Z_M#mAb#A5s|pCwCo0TXb5l8PU~`YYR++NCeqXCu%j??>^>O
ztBUR}V=Y}w)9|X7$hBd8K)}}>;cSRr!EKL^Fw$jharpv}Sh)V|zZIC`ggZcUqzt&+
zb3d}*oX=HK05p3?-P$2)abLfrj3g*1zPB2qSA=jxExyL+^ZPgD3-JmTq&QV1pPQru
z+hJ_PeI)v+%kk{1%{P}vkNe}x&6r9$C@gK1FBB@zHwLt!Dme115|M#|fdPH4myX`G
z`XT^cncXGvy+XFL`dKQY?Q~{`Cr=dVcCN0Ti);-@(6mI5GXvo{-#8ivPvP}0I~n{g
z;q?JPCuf)dM?Xu*HL2+vsKe?lHpIz~k2srIk>!jAovgXt!zty7yPD7|E<ms|m4l_g
zq6u++%ERT7it;?CwO4>stRnQ(#F&<CvCZKYY$SzAQSs3xI@yWb`9O7EOVXPg#+t%;
zg1>ApY=cq2jcP4bV2VC;j;wfctzffrVKi?vcw}f&@AR3m(DQ5P9dHk-Wav@j@vj}E
z#!xr@LF1PR_@1a%T;JA6_%V0w%h;UVYh5q#jZ;XDocBiC&&n1@w$)K8O&l#qP6F%I
zyN#pe9S@QeEZ4aGw+`_Jne>s5*Bv={C|LR_SmkOy^0>k}QnXx5+6remSRzwQ@Y0lr
zRCLbcd?|FW{IG;sXnLUB%y*A+Jwwi{I(0yU=(FN3D*&xdiIwD}bIwMVe0^im=&sRL
zqacZFq9*i~h_kzQmomd=F^;^|YC%KJ3G|<|tta5jXB6yh7QI)GZ!|n2dW(86O<_zm
zV}%)Igoc`=;Oy)}X-gaDxX!1<y!E0V4y%?*a<lCGbj9S3$zdLWx#dw)c=}v=2(44{
z)f6K>%7=CxHZ|m^n#vs720yUgCu|+oaB(cYQ>GSbZ^CJ8j_SiDda?u0!$Yka!#fJI
zw33ftzldDDxlG7PM~GFBd;~(LT}n>G;N#)=rgbCEsOsnzqTUr@R5wBm8jPvUom$=G
zDaVN_fb2iZyC>-L@cW@i8tkPqKQlFyPuyC_ium$hAYK`&cC+^m3?{~MR#T6|^{*Wd
zE|U*3&u%JeeX7+kw)Q2R_D{-?ji5NhMI-TI<}g;=PC!ck0-K;Ct4MlPW|SqsP8iZX
z$>@lUcq!qb5RD&Do@2<-QCw@_a@fdtOptY)(lT;;-DR^+HNK$6M$;dyJ26L+Q<dMP
z^r@#^{<6i^C)lMLi#rp*@%k#mKB_iP<%5_oLU+m1o;}tX@xOCESnoJdYvYhy$1aBn
zlf2}$O710&z^S4p93X&++I2&Zv40;H*$Y_I=&u7=Nq&;Zn)=9EQ&_BYypZ#X;-@KJ
zUxsro&T*pSb5{Y{ai04+?ikEXEldBr^;^Y<nki!J#!Dr+<kIP(UI#<n`C+TceSB*C
zu^NBAGOwciiV|0~hKzEw4=4ajTaQ*)rKao;VSFC-xdyfaJ-seZMq8X6CAoK?K7u~G
zQqi??jW6$I%Y2I|u5REg(bkKQN*sJ|R1bJpBJ`AX?(E{ZpV!3)?cw86qz^Zxn5O;%
z)lTFfcuCl?%%_-Za5!syxOTr`?47f6B`8#$of)~_qYr9F$(^E*5>4*AimtyQkW}AC
zqHQuMeXfx{da`V}ZQLKf6-JLZT<oH`s&(|pf<Tcz=}@atO|&M+DZw4p;z=gxDrDsk
zpgu@ycO&C7&vDFimy0%nLv)J{)ioS5C?s;Jv9-uR{4ot$SnP-Z6`f|Tvq(G!hYAI&
z+jO-k#YTK}^-mIZg{2$GA|e(U)NJfuB(Z3=+>Lxix{u@FTi>vIp)IU9takj)=(`s|
zzG-;qGb^UVyb@1mZQAT~M@0i|)Vg;OpG$eeO*w<tEUQ^*xXk#|zqW6Fh$k`p9<;#2
z6NOMs)}k;BxU27}nQKS$YnEq&4N>b|Ss&^}JC#3M2gJnysnV!tE%zcP!!NkChJ>6O
z7pKT@6F{eMGO3$T)k6mP&dJ8II;=&NN?H9UuSw7EauhuJe8}J!Hbrj$)z-DD{dYaV
zpmYzNNF_STis@C3g}UcFNsY4J*{DZ+8m?u-JRPor#)sv4zX*O|$=vwW!@(Io@P?aD
zU%qT$TaISgMWBz%Bnvv=XRpb=3g1L8QKwESE;mC{s*#D)$Q(h~*5uFfX?0i0Zx&6v
z(*rE<=A<pKHbfy_s_i{KF3S{>6tfGXp1&-AK5-L}h*(d6_d%YnPtLthy$TLXfbv3e
z<Qpam)XNvHVVkU@(V*l0j{_{v4C3+vx@D?0mw?#(2fqAQ!&i2yDS^daW!=VZ(`_xW
z2ysi8T|gDtodMVD8elVSQ=<rr@<a<_^P{I0o=OM4tjl|TZcAmFVHK@qwo;Mb6r_d!
z1yoy$B?kw|Ee$xNeu0V_XXi#ZGVe`U@D@Igh^Nb8urFBZLLNDTN{y}SnxruJrN5oB
z-r*Db2?;Ltzxwvq&mIuGDDAu6!PI}jL8OzPxmupMJ+Qg{{g_`s-Mj<?IKCuexWA;M
z2LKpf@(ts5|3zrL!AWAq;YmXT{?h~aFMUYC_;R?iyZkSFiT4v<`iZR}{2@-?(|+R1
z^8>qszwqVTpZHQYhF$P4d};F2<R{_trsJ;%zJO8${WAF}gYY!|_6aI}0lN`NbjvCK
zH0CS+Cb%eN5XS#^F8n+UHFS&R+}C}s+*gxD6kiAXoX5Fa?y?!z_)PXzf$72EJ2uHb
zE%+>h@Lw!{x6)FBeH687_UZ|@-s-jYpXc2Zxldbu29;{J_bTWuE~R1^8~r}yJjwl%
zlj6Cq`u8hQd*8OwCN>8t056Z-uDRS!GG~Xbx%03fJ~}yI9GA$eI!Zo0F1g6d%HltA
zRwqzQOI?(#rYTDB4cjk5r-|$G^SE8&p((S6Dn3R<c~DVP7L?Ia{qFhCLb`Wd+XJf!
znT3XuKVX&Z0!q^cbx0I^G^qg`_4bz-emqljoXUnRY4*@(i&J6>ZK1qRlKqR94Td&8
z-7o}JOKM2GYZ_4D=(5J5BS_QIw}Lf?eB_4)DgBYJf;OvdwtF4eKy<I>x+TPwYnVrl
z_0<=Vz}v327pmt6-{QVYuvwxx@{ZozMC*&bpstM@t8gG8A{##BxCl5uI{5lj;b3wT
zu(7M2msa}2ZXNVkVXcx8Dyo#mN_Fh6%u>~c=U-@aG?y+dXZH+h%A~;Hh|v)xu&~?s
zwVUX3Px$LX5^{3U7VWwzn#iIBZeOr5aFuHlEMPS%IB6%8TUOK?n--oASjc@W$f9eR
zIb;Xj+Ls`vC>%FQF0~x$-|m*DWPxppC_w1GiR%ksa_;rf-DA|T`F<nrc9DTcuCwvY
zQeb2mR?B+ZgCH|_dyRL!Zal#6r=O0AOQc1uLHmiZAdRAZ<M}#MjnQS&_`JpGoV@<D
z2+>}?7E)~N8NsEALBM&p6kRn9u6P5i?!-?G5=LM>UQM^gJ$4>lINw=p11yH4b5>zD
zkhL0oe1?#I%26X<bukuOQy%soVk2HW99PYr?eEbDzYqyvi=h&Mk9G)hWP4o4^9+`5
z+!xxukA1%U(&VzOBXm*ew4K7Vp(~!u5oE_(JRN3*bW{}Pw+q%q&vhP%U+&>}-Cwne
zn%aJ=!y@BNRpI7Q`VI+F3}<Q5OIq;R1^g6l)M~6sxgT$bE3QZ6##Kt4PtSTb*Gagk
zt0pdgZ!lTuApFOB2t55S-a|4-YN}zimbRv-kWkx%^_749hm4-jhT9D;GjZmM5;pk%
zi~UgiU;7~y?JxTwChX_;KUK5K^`Ks=<slc&iW*YV{@v>q>Uy_Zq}e=QZr54W-Q49g
zgm8G7dpU3I`q2y6|KdJm`tRL`dvVG1S&0u`KWu#!cJNB26M<sATMu8Ytu{lb$dbwd
zUyxVu(oStZsTMCZbO-17>~H*NnbI*%XwH-X=MzQ<e8pMI5c}AX%a=TU-F)ASm~x|A
zWiz{Qaeg-tApAl5`3IS>rSqN7)zB;60{#1SGN3<kRx}*(1*SV1LY4%g;0Htm1lb~=
zet}J%e&j~(PFiuqEb?Zw-DUxZbYyj;Ponq{7iWAXtS*(amJp)v8aG@XERUKUOtywR
zk4w%QO@=ffyeP^lxP;2W9vz+#g}O+_uKR1wVuev7j8^x0E=y)`#NQ5S=4{?a7UHGX
zrZDkLOSF))?OLD)1uiL2Rb=FHqSc)RowP{2_HbWq<cptyIlCl8EI7-4@NL})tht^r
zB4H&tjE#OIpXmmMTI4EAL)I~ci6WK}a&B9Xc8)c%SyUsX3_Ds0T^8Krw+zq8+FOPx
zlhxqAfB+v`V*L6n-6h4D&*(K{^vzjGLjm*c6G@{j+6cEE^`oDhD@>g!_mVNU10Bu8
ze5A0&BHRkpnC$W-)f$8XY6kV`R_m4yFDot8K^1f6`r~sHU+u>-C^k<D4YwylQd6V}
za=+q*F$)-fTz3Tu-oI%J7^>c)Zw8dYr;AIYDBfLWeQ>|d$7MG8@vg!I{v=Jq39gjo
ztu$r%?Pk);s)I)c#quw&9_#djT4<rd_R-~IQ6D@$ROe#}GI0niN+x-ACx61${$WYY
z#B^cU(iK_ih*~?oj4mE4e38x5J?s!}7T2<LR%XEZ#o=`rce!zOLCgcYplYa!yaspG
z=?R6?)3Sj3*t7v|=1X{%>=!a@p(~w2xkLsN^~=ky$=+U<V&;8LJrO+ZGW3K)hMcQz
z-tXN?Og!R`zwh?P0b(<+92^{OD2Qcv+9WZaA;aX^Dk?|y#D)h*UA)h3*Xp}>_P5{W
zKg{8I>t>+UNe_1M&4FmU$@1uuxM>Ex9mr``@XC|k86i$2o5@6!!nmqlR%bbz8+8=k
zZqF0#KzqxhaCx7G&V}ltN;CmJwl~yd*{};|i-d7f!us&PfCL}ZvHa!<)(Hp7#dNef
zm{G7??ZfiRH4%y^6^oe8$&9LBL#*EO2uQ<SF@w4p0KQoBl@a2Jd=)do{*zd*IH`hq
zKG(ob4kYsmU>u@{4i2CLw`FO8D7Ep}1raQ>p;gq2Njv*T`e#iE<dKE61T1lARSN6s
zjt5_)A9&^}aAn$B1)W|sQ5<{<AA`&#bXqTtL$P8kG0`}4a!B_*{4|k7H-46m<~X1|
zY{EM78NgmRB-Ab6_=bfYjx~&ugDa*sg=*Q)LEWLRbILMjBJp_2jVV*j@X6!~vjS15
zyT;TcDS2y3pThjkt>9uBZ$GaFt&}9M_`!CA=<2ZUrFo-gsdPsl{Ptyjm{RgX^g8~P
zbEwMMaPiyS>B)v%w2;%At=pFqm2Nn5h`1l;qd@6&Xgf`LUNbaHMGdVja0*=8B|AA6
zeveHPW*(>|+VQEA<5L*k$;_-YPwR?VN2&SFTV)<P15;hXRzMsluZg}EzACiF=V{90
zB3IMS2)@l*UrM^C&oADA4^`5ablv;~tEd?^5B2_EF!<UXdrkV3@wl^_V%`pGW{h(`
z1)mG)zn{kC6nfN{&NVowdbb5&S3t!?EH=g>p+59hv(s15X9uPXQ`D%HaK8z~**x*Z
z9ekfk$7oE-_=?SWDY%!p(HP~x>hd&+qKV#oAnw+Y=9Dx{4qkk9wsUO&)F0COY2`$M
zvpaD>6?1;p)2hsITQ4%3rY<V6l*iR(o#Ci)wOs9;^r^l%L&B&X6fxf56dt#<4cvhs
zs02mn&g@G4jk^+|nwtyn)*INP5kVuA>1t2Plkx7jO=|qv=0$?#Y+AdR)~2%$vt=)u
zJZYlSwlqck&A&#Gd0nsRB1PYi_u)8_?oraLqK5}gdhVpZnKW~ZVy!y95V`}X)D|xw
z3rC$IO8`IjsgH+RJ}x*h&~KOS=rc1<w-~~#uv(Df&a^-9`KBpbX2M+-I&cRci47=n
zWe;`&P(2@3%a#m>zc_And41?&04~!m3-gubBER`LiQ(%4AUPp<rOrkrb4FQGMvQ%H
zG!C45hlnVP`bU>QKx&RY0wO)|uM+rEw#{a_zo1!gR@LE+>XsZ#o_?RTYjI9a$s1yV
z<g^dZOcs=|t!*u2DIT5!RH0(Luv`+i6i*Qp3B9&m?mhRM5L=eSz%#KkT`G9yEtO%a
zJ|Ev(6t^t7vklk3LOZ|HyH!?DgU)8zzL8;onnsS$H;q?o4Q^)r1|3pc*OdHE=ZA_N
zwEF~pfPBd}c>Eaic?qYRPIlVZ$!zM5=c4z)sY<_;4~N}JF5V5`XSc6(nTwp5VK$TK
zpm<U$S*~Kha7!rT(63m<Ju9_wZS7WB#)XR5X?>W?T;@e|7Y7a+u8be-#tCuhU)4+<
zEOHO?bqEkchc{Hzj?c{nromM9h6WU-_aevCO=m~gNNbdQiRtW5{u(1L(3(^nbsIM$
z*DfS*4CC#eQ!<;mX0o*DEal~9TYiW=Us$|K0)03?KbOZVx<>E47|@X(I-7tmuk_~O
z<x7MYFA-dIp@Id3P)A#yC2jWRvJzU-_TkcU#2lvbI;-FvuruD39jhE<c{kx-)jp^S
z_AcZVl)e|bw`_akp6w&T>B=fkvoWdS80BJU_toP%Gp;EYKkm@EBWJ2;+jZf=aEUXy
z3mjUk;KkX@KXprimw$Ga>H$ov#~Ff}zNvmXloswRuxxd}F|P)DW+f^be3wFJx1rhg
z03lZhu|mQXU52F7Bnpood2yNDPL0hq=z?*#&2G>1I~#}lzJ7LP=)9}37G2_gUF?Os
zRrj7jt@-JIh(^tEN?}d9Bj+8Lnj0D6e&#CAq&|Tf2Ce@1a3zu#ZvozHW$?pMz(-0`
z^`VfNxSKvQE*26feB3swVWUl;WPX2K^Tac;ha^ctHchvB4@74E!J^|P{`%=7r~KhV
zzWrq01D`-+mAnGHhfJ!;v<K;<%>w_UJ^_??LZ^U^9gL}7<(kq3d?9ZS3u@(cRh=^`
zEt!nX>kO4US{Om*evhfEv<7|x>>HlbUhA$-TbO@723hHM)W&3yMOr%(dBW+qF2>Om
zOlDy&IN9plpvx_WYw-MNy0hJS4l#{&>sB0}cv4J;n@+F2$!mUwo!nkn*;y}7fA^uF
zW&+;6LZ1Bb;JGJz@RQOtFj$IWq|i-^#rV1W^aX4(Gq435ENBiecDz=;tHF%S4tzv{
z#XmmsyzCa*Lte>GA#5FBO7Bw6gDcr6{`h*pkfpH<HCE4qv6RQozAV${u_o?~4>wT1
zgiJ0skR_tf^IKH$OoVoYC0pf@g&jIBt+bFjslpz|0+t$$wIvcia8QfI3H&bd?>6#D
zDOmi33TR0?>ZA`<bB0J{)ifSScNrIH!lJ6`<Y|tJYe=dqvntN|UZat{z1+)+Ia|g4
zIZ1#1yoor2%aOP?MkuDw3Y$B3TtjBYEs!{90L(9!>-r9PH3q=MJHBcliI39R6P>Dw
z@9A3tSn_BjqF1WP^VpZvojxjWZZt2hO^l)<E>pIqCaTURQ*Q*Qy(vY(csPZr-l?-%
zG{0M`_$)e=$6j$m4W9tgMtEgm_ob410sjK==bHWV_-_BMXYbh?PjVAONv1$!GN|Tc
z-fRO1vUuW>c4Mc>CCi?de>XI?88Y|#h8K{194~K0Ot-9feyl>BHl5Uw${bF&tg8*Z
zg(ZO8_Hz~)#rydY{yONHAOgRPQ=`HHFz}e){#z)x+;1PC_-zviB^6))GgSV8fcUa;
zFCb0iNJW2r#=o9GE(C#)n*9!0$@ibt?bjOjf#gM-S{#)8f9eGOLp&OMGsO=<rC)gR
z*I5W$3aZhU4}WU(!dIRcd~+zh9Lhg0;@4C8<sfQ=V#WDLC@BjrsDvW^JVQ1T3K9}h
zRr0uB(AM4ET^$C2`NQAsaD>toZ+3LcVEwCzmqg$?3-jB)`@3xokofEpiDc%l{_PuZ
z`{)T@w3$Id2K_1S1w^*Qi!YV`0}nJNW4}&q5QKKd$qX)J3s1fqhJ#NH%h1M?%!Fz!
zRYrNJKF^zzX#zYAQ!>j@vN8lLrIv>(<FbR(EyVop_m!h}mQ4>-UJf@HF^9mJh&X1J
zoF(&tFbQ!bgU!?aa?(Pds}w%7p&BC6;dmqctq>IoD~nfsQk<%5Mh@p^<QJb{q?TPj
zZ`r_S?_i1DJsb~f$)r)w6!CRQ&mxe=`plg<H^u-{MDT|0Qz|Me^Th`F@6KjLY-&x*
zZ^xJ_mAu5*m=r;q9+9I;Piw%4klZbnr`gtz?v!_!Qff7^drFr%iFj5bWSMK^7n;N*
z<-v#J8P?@iZBW18)eRYB0`OiNB}|lCJW3J6VP1)P7EAh^6)$Td90qf=-mQGo{@i|2
z70|X`N+BWL|1D)#Ek`<DP2G8exvzm;LW|B|d3|HV98s+i^)S{nB+*A(9Fbu<uffKs
z0l@>9Q#>z_7O^KWSa`1h5j80d$6+*Ottl$<y@)%NOGZ;x$JJ~ux-#1EMlhjY2mcl+
zgd{6V!PvQEE|Kqym}uKozzjnzE)|r|XVS#v=7@KhZK2%EZz+CT2-VxAHfblU%-Tto
zyF1*=QbLk52FNRPym&xyS`6A#%9IhgN|y<|9@~xuO43p-$q2-rjVagXT!?`vrDm)3
z$D}reFn^E!B*HTDWxI;%>g>sTsp0S0#)dJjAEne#qbfTiB67}_`>O`Zq6^%)p1UVl
z*|?$^;o#ZadXJTl6!p(*RX|y3UGU$Oj-xV?pO%;n9-jzrBf3p#{7l1dHh!#EvU*G4
za^#vJ6^C2G0(#Nu44TtJN)Wd;M+f@a>r>M@Iw(1nzonS%R&AY7xbLNRQCfZPW}1{T
zSIfmb<a3hCj@X@yd{b*9cs%@=a+S(1b6I#d+S`LpvY|c=oe>2(N<YJRatq6CDeWK|
zOB}w;B>m{k>?1<%19e@%Sb~CMrhAWoIaeNX$LK}x@(S4GDTH!;UL;6&z01#0&vCJu
zT1|QADT#ggc<h*bW2h3ZO!Ym;+jEtH#C;i59T=%I5$|MQmg~be2~?kY|BcTjaIC7@
zgZz7cM2V)1;&k!eVViz6*==3@$R{|mq}oda4~g-fwxvj1Gx?OK(q(}_t?#_QJ9#1I
z`|A0qIrXinD&5`i0gL0on3B2bq==4mPCQ!>NV%K$sN~LZHX5OvLZY^S86$RlM!>yQ
zvcuT=%&xDwJj&9dN!oegYtc@&;rimFVeD18a30Qzgi;e_{`r)$GIN6n)m?nI_Fyy$
zq66^m<OUcG5V9VUzBr1Fk{#FeAwh3dZHlk)N3nI=KOLH2?@2U1pW(LY*E@4?N$;Pw
zCMV#l(4fi|*!a|co%ZcG!AfEJgRxtE{Y0VBEB6)?s!ehahc593R~BucjZ!V97jxBH
zvH89*Ktzy23#1;RoS~JK(DPaf6{(DImvfQ<qtHx<lt!%v6f4c}sf0@0PTYF)0S#=c
zrxKTuy~oB66q2V6iY%eS0&3GrQ_`?u^egA58t*iulrzPNYBMboc^}nkzXJD0xyHM;
z0^ZwCJmd9%mZPQzGQjm#v5LL|WKoq8$e357PA*NxIb#h;Q6oE2;^1i6lle==dhAZ(
zB$pDG@TI9hBsIIrF?6oqf(iOR?}7i80KYuB)Y7cz8U1SEpBRIYN2Ef0-_b;lv=UNo
z?-&nfZsdg1op>rzij1SBaOD#Er-&~Pmx&0a3-AXdaU(T4vl8qL9)+I_ig^t%4ovmO
z`xrj|j5Dmyq!=EaB5*K2gdXfmQH((V)WX*RovcoUA2_GK2<&*fo!S+ELkQxnptw(j
z#JR0kA7*D~M)aMpf{Xd=)k6klgfG%>kptyA-(OwKH+b!(K16?Qy()TX+<MDgU7!`P
zWy$$%2&yto`7i?k#Dij-nFL5DbNF#wNDk~g9HxWKxSqkNIo=S8WSHd0zKG{r;W8#-
zpT_3QmSxLF6t%kTCRl1t+7}Z-g_qh)A<-5*eIF_d(~O?kDzxrin_HT;FY!3P+mzuU
ztv!~;R9(q&kScyOS;6boH@;e0Mkd#kmCH`*Aex)QY_#wKbGi}s8No}57cnH#*?FR{
zo>qFidk_$4&npniD#reKhK_D;4)b6?8^q{>QI#vuo?K9T=1A<E)afi7Nt;8Q*qleG
z{e0<)cBk*i_x^<XVI%+j3j9B>==&=Pe41Qac4a#p8rn4f#6w=hHr$%K0@LG!OVj)E
zN@6{I{rO1HHoLF~=6o}W$APAq;q(_(Q8i1VAA9k<@Nx)TYIpW(cHiQvF+v9qW(M#2
zx3!l)*7#;#b_a5qHCYP`<i>>Q*+)NuLol+rZ`%5x=hEe1IlaYlN!*zW+Z9eS^Apm@
zxQg{BEjM=aAb<pOhK{uf8~sc%kLqlS8S*)s?W$q#DihBEmrS||KlHp2sZZu7pmRP%
z`Z+lj@W<DC&HoriGn@8H)n!%KE4<oo0;s4OdS7e{SM<6t(XE>~w^JBtU;*#zF`=bT
zVQ|?_^ylVh^E^oS5Xx<zASR2~im#*|Lk6SfVXiJ^b3IPcq<Hl!)U`Ff6Q9y0143s<
zhI&~;=jlj|nlynE-esj^y%!$n&%ukSIF8#^j_R$1&nul34)zo?^FYwfNF3@RcSg=F
zi57QJTGRneBmF-spRfI=@0FikD3wl#E^DY!X94sYHkgd|1%@ee2cm;TIk9j=da-jz
z;i6kPv`}mNZqPT@%?ikI3{HtFBj)0&dL^&f%h}5*7*ekYm_nNyf;q}hdI~41#iYD=
zF&dFM6bE^9*s-LIxXPS+R?qd>-0UVKTB+sssS0d&G~VN(nOxO0*l`Et4#^026<8)e
z(NjA_<{oz{A3&`G<{{`Dh`Gx9Vo}KR?`JIBUdOmHbrQG8^CnvvUSAb@&07TBb$&uS
zTgS(=<?ic!m}WOL+~xM)F5R=XZa3!~&T1(ejb!6X4;G^int5W9tMW7W$aSJH9Je_?
zIo^kLV1GPYRpYMZ&)tl!{shyYhs39(q}Uy!@+Fi<EA^(^TPpk3qv3;nIT~fpTQq&-
zJaZ$q<OfZk&=!#7xU2iKr6YCmN*zK7RlqMe8V3(y<@Gk!lR4JRaZuahE(px`m6v+f
zR`&+d)vl;>?Bm%KA`{Q68r}_k)#X!fDCF-jC(x7EQ_$|^u@C^gKR+8z(;J6WD@UX5
zL?&ca3eORd_|5f^J5)%P+F#`w1y=HN4Xobu*EgyAj5ZF7*XSSC!rsTvXkHA_cUmHz
zC-<dW*H(~XKU0vV+hH;lOBzkR)Tg^V{MOW|?(R099I*0%E+?sjSJL%CubR$BSn5{d
z^#!K15Z`k<q4TLn-e)a02xvXI`rzea3R0a=oK?iTPEL51ck)zylVZp|4J`TD`oz-}
zE=o;6y^6imfHi@Gt1EjaIXnD)I8er*o{3U}A^`)2H*N#PQCRuu#cc)+B}kxfX=zCL
zQeaI^#HW#8N-3C3d2SBm=l=}HlW9a#5h2kc7K>)19G3IO#Z+=`Jhmh8`@f*l`JHB{
zgd)@DW8T>aPPT#)x(b2|Y_AqwKX)=C5$B@d7x!+5yzW&(ICoy-AH7=MD0xm$FB)pU
zU}|yE;QU}G1ZM9hb=_PQ>^=G8AN$yu1%0yT5mVH+5VbT$RKi%tj~Dpt&~aKlBT!Eo
z+3!z2)G>7%CK%#U!;usne((tB^pAE8+*F8}JT2Aq2T(tuAP?e)RXojj1_R}XuvPYj
zD`Hw$g5a-glv=aQ@$wuveNMcNV!*uJ9jx#!c`{YW1ifj%>wEtS&5>T_W$?7jfsnU4
zy<?b!?L}{YgKAh1)->rYgemm*qADDvn6xi9d}_sP3G2K<Fu0r!YF@pdt?Rg6^E10<
z^}^gN1GEeZkd7R2m`BHuaJK@>Q-$b5kmpOb6LI%q^Fz#I-cg~>FMZ-3W`%J;<^#FS
z!-3W&?@VZf5gc*Z^ATE_33Glm4!Y8Uoq<R6iIQ|)KIh-P{EZmmtP2fl-#t%THr<kt
z(WptI<{ENxMYa@|W^XhDC&+Aq?K~b?BoQDYf}5m$xa@2A;PG@Ha4}ueZmuPy1{IiE
z^r5eTJ^(v;P(i8zxt!v)ds$Ch?aaWkyFUoL=_$E9j;#g8r%pGzlvP{8yWQ^Q6dd7g
z<a%bYdfnT-EP$4Q2H=CHx@DnK45Hsx`EJSUp%_q|bn@URXmiCnKh~jEXm+zv|G;}<
z==|w*{`ux+6iVZ$M8aV<KOqm#V~NG?^C--wR@|f`3KcuKO0Ct?;KOk0<zBTY-Sx33
z&x}RB6y8Fw&}MU@_Jd(&h)A&|QnyVV=iVA^HM14f_5nMpf^uvMBh*kr{PEF{3$A6c
zRCh`Nn%OTZwi)*QD5;g4mnW3ic-*$&(V8Obw9hQW#*tz57CE;M_G(NFoKa+Mu=>c*
zs=t)EqEM9es8~FFwn?e+X;+nUy^$KJrax-DY0_!qK}{Q75eU@(K^<!%5hMc=!Gk|8
zR<5+zG<q3bBxmPHUyN1dS=(4F`*9nlaq+<jI4t`N=#0AqLXb<p5a)s8&VH0BvVVfW
zTdyF|D$H__kE+^CtH~|$S?PN0V)$p({CtZ*E){JyQ@Dmr8Y9B(cx^ykFmoQLhkR`Q
zoL2L!yxwS++0k~<WkcoKu;6F@*8LRgCE>(@u>=T~rAk9;7i-IF<mwr~*$Dq(ZnAXf
z8C!{x&+bD+t7!+F?eLb$``0HPUAlibs%!#eNBu>Azuyg>4b=9D|NaF`P`8tXW@b;3
znOaTnLWvQB!rs;!xWhj@-uGVYdrZzmKjoVn?<IImtiKra3NO;<m8Pf@JF`Cwnj9WX
zmiybagz-N93R8g3|3laHZRlWzMn%!VQ;&-LRUsybmoHx$ITtrJ%K{!G1YG7t<KF&7
z<jbfbc6WF0-WZ5$ML}@=>8ckH*I!;hZa04m<^0o<7myd==3SDPz4|LYU`zLo-*ySQ
zAP@PkzTua7@kQbP{Re(lgBqF$mz=X_{^G6Hm;wh1%UWn^@)$LlfcjlSR3Y8PfVAEI
zW<RkS7kxJQG1I3jqPQgW6S|fpO1#84ap3Zk?+-d~U@SS%lQ+zJ*>Pl}zCuzG7E1<d
z-$Gt`%@>J|>Tb2?mWtVF5%<oZpCB|`W@6jNWQ+37_Q?H_!MQJxAMl{DS34f>z%Xq#
z@%;2{K@-^XV9?I{lbb$AVDU@&J=)}k&JQ^-GA6WW)&VdfZ%6l|oSF{pd;SfyT>E{`
zh}9|V2h}5r^Lzod9+FbeV2D>fFG;YCGnqQpPIV^q5B6st99Z`C3^4-8LS7e6*zwV<
zuPKU$C8Z~St!jp^cUBc+jaUC*CJ(nC%%Jd;<)EUUADG4lY{ismEn1M)X+2@D&O;Q1
z$~W8S@Ct~hd0Ba4YrM5Fc60oss9&l48NT^v*m*3g<nGL;)v}S0P=@M^1Sxm>azjzP
zpZZ3wCpN`Z1Xk*-PlTF)1h|2zFVD+*N(zh&PakoRyW_T(E+KGg|936?h+k%@l4QR`
zz3eq$=wf*Afi91tf6eaP{8L4~f)Oae-ZrlxM<CwUJS7Dv+Ut?VI2+k3QA1hIabLX3
z{P+yYh)9bh8$|_IT#4AnQeQlpSqx!Nx9F`PpJ~IVA+!5H6m&-9x5=lH#T3o@s!t!6
z*r4IJ0eKegZ8!Z?e!W9o$(%tGSy@%g;u6F1UrxtgW0|SksGVKr2{KG0n`th;H^KSv
zZ!Q41gIkzyE+!>e`(h1rlFbEA7o#VjjrFZhTFZ}eP*ZchE#jK$8XBW{xQBT;t!PrI
z<(iA*@4WA#JyUqSqMx{Ic&wnfGW%TXILCXAtai#-VR1J+qFR0dE$;7-a6*FeV}s0h
zmX1E|9&?QE8_@*_COt2C63jMXgQW8eFf?GTc0snuO}2jG1v{#~V~j^>E(#sS;LPww
z-G>C-4akZqjI?y59?M68Qd7sryxx&}kau#Eeb$tNbA6#*JaduW>h%hE>b9($(h<)X
z2Tk@4&KdAQ*BQo>uf!nNv)p{fbBM^4)K(eoMB&Ym4n&w(k8)?Z@Ar;Z#S`^QsR;OL
zT(~gD%JcgglY}0p!&nQv^b!(NB)sPRN5Cg495C7o+xaA!%DJ55P4C59LH7@f4hTA*
z>7)vE`C6KYlwyz1w(2v?Bh1%)0qKK5xpN#8ECn#X&f5`ue$paiZDcJJA!L=&49($V
z#T(m>2liM@=L-SN`#d;fb5RPEopXaQrxe{bpiik~7^s(BG#_`G7E^cYwa+^1#B}JE
zL@9OynsWjuyI%eqnIM8dD&%ms!g=gIVGP_Q>2#!Bz!g?%=E?JF#y`8Z&kVrs&!44m
zz6hSd9?K?qWU(V=*~&K_?4V*Z+C?>2ZlwHIdSA8v@1=JlCaR#d8H?GLkGAO!#r1Sd
zI(VPrQytwuVJjW;PWo+0qJO+9qIg=sEI2FWu$2!Pr0a(HW^^2t9*Tm!(~ZJ);UqTm
zQN%fz=H{B*T!Agv*giZjiT>VtR@q#>GE|>60e~^o)WYfnm0ei}eCm=-X3n5H<nRU=
zNM>GKCIsPtKT~sS3q()-Kp8Fjhs7{IqfE)1IWpea_=7`B@}6!WV<pECF<a0TuptX_
zyC&0QH{vC*>VWxPr@f~!hUqftCbr>r_TgeI*Xh-qU3hc$Q3>-}G-_3HtFHboV0L3j
zhEu0(q<WnWALjQAe)QINq9|*=!P4$_jIqL$Z1{c4h)S(=y3M@s#eM-!T=ZlFw(G;f
z2lv2K>;p4ykDZRLD@%d>tDr)!fA}o8{P;xrr0%)pDO6yjGT?X>PoNxtk$H~Yw^^}P
z6XS5sL0X!ckPTgX?&QMYrY-S7L^1Iz=3W_C8m~I~Zdd(m+V4J5sfIHJtw#MWlj3W0
z7Fc^84UP6|#);UURmOq0M9Zl1m+TkOl93<KHZlGo!8?8i2sz)=bfkto7ztn3t;~z5
zBywx4KjUG~Z7R6y!#lyLlvSF1Z2GWe>wFzny_w5^7-w<YUrIwLPj(}-j`?yg6&tMa
zh9(?xW}F32D^PQhiC9(hIkU2wPv?JWMoLv9g$VFqEfwJUK{S!L*Z<n5@WE>acB#mH
zmsWXf&Y$M@xQrA0-p}yWye?p;GF9T;_%T+F1g}C(a<>QuA3UgDFn2bELSf&&>1u>x
zZ@GcDcR-(hm@>IyB-k{Dp4m!#P7&k*R8F0VLmyh}$f*MVtUGOIWCdua?S~vwNUfyd
z8*3CW_Fh$Ve(j;*#clkaE*z7|h*xX98dr(RLsne9L0Krem?sgre>MLctYbeCej1+{
z(hgA(lW@V!*=&S9S~mju(#RO2eyKETDQoOyQ`YVsX*RREoV7bhy^Bt2AP_Uds50!<
zb25M8BD&3|NfGvBnOB_BA18jHdSEN~foI|yXT;HH;1#e%l<(ZUCf?)6PI(P%zBIp)
z7U{$5U&z9jk#L0I#4IMtm@%Sc)}Ix+YEi#d!Wox9Eo#NoW*Ah9y*U`S-pTbTe#KIr
z=QFDHctpCq7>E`B%==v3m)Xk-SE!Rr?sINoLty@E#=Q=n8zQi<&wSXV9-VG-uB@++
zOh^#D#<SpZ#*K$E;5@WY7iDaxx(F7Ob@ao0)SERz29@w4<p!SgwfU%*)%7trW>eSs
zItka2!1|jlx24f^=-z_GtA>#mQz)C01D|aB;#{^#olMW86)qlX&&5#hG-aem!=&8C
z7+K$5nTDz;EIgeFy*C&oC;f4*jJlG4&!}1F9zpte%T|AaJo>{bD37z1H=W9ZtGL+e
zMvOkCNK*4!*=e2o-?>T#0&Ke&5%Na)+H{(25vzWeQ^e(&OggBRxg>T=-%Swu;@-Pc
zdaoPW(5F92C~hF4;I82Gvhp?7PW%(j?#iqvQjn|~fEv#J*gG!f8fHxA3@qy=+}3Mb
z?Z&$8n_^y<%Jknkf>nvZdC#wRwHBX-xaZYk+!{DfZ_)(FGWC^emh0iF=TdpHNYobj
zZ8{Im1F$X!Itr;t!@><uql<{5^PlkX;FFtNE0YJkQgb)^!vLKb1ip`LBe)ZVN&=UH
z1f|q5-*ntCJ<da{1C%Gt#uW5rwfCmQHgy{5QXkHRvWnP|k8_Qcv*JhOgTFK_UP6aV
z9rBgvtIV<HeXKC|qV!<X;>dILY>iap@+oNjMtt=fDSU5&qF&1PK#|WCZa^0*u0Fd$
zvs<BFa*8uQy_srs640i0_#Ei{#8ukR5}h`v?gq8&zJ}<$Avl)T>tG63I+QTenUR^V
z?67O?@R!zl`X8+|@Gq@3q=BteCbO}2jBTP%*Qrjg6?8Bn*xYzNiH8>L3Bm28u#pI>
zja{lF|Ci#rMI9?4g?o;^kHU2~Z6jfJ(mj4_#U(aD;q$UmdD*X}TA$6mx8ji(;j55f
zJp0g(EmrREvAei%N&EUvg|K|<VET9!dX6)AF-eeqj6Bo(;!rjvxZh+AA52JUM252K
zszhUwq}ubZ8m;`A#yL~Ec@+%u!b6}Avd?Yp8s_^K<Zf@WBMq%ILW&N6y;GG=Aq*+C
z1*#Vvd}ggXuSVZwAX-loE7y=hyXhsgRhIhkfznY4YKt|bbONaHEA(FP^{iELtGc`U
znk-PiHgT(i+9CQqGCzO!`-tzS(>-zQm;ZoC`AbOk2Pq$4Xr3?I^%*?qUYreiylivZ
z9*~9jgYQF05Za$9$D4{p*trQnXoS-n`Hypy2c<I*n=6ozCLDFWJB0t1@Z#Nq3|LD&
zzw$#qG6}P@`om3LybJ@&p=RZ^aIk+-l74*f|1hqhiXs2dl>eFQbTv>1!$U(U!}?b+
z|1cq0>v#X?s5<}K>8J$k3QUY<Z6yX(`p;0ATf1<rI?X}uUi1;D_Mpb{>L8gy_ZHQr
zOY4G<YQJ9^xdH?h-Lv>Iws)YR2bnVwiBv>s2-~;>HELp9L09*BqJh+w$Nxj+R9P!T
zMmjUU&?Tn28s*YTtyJ_X#S9}32$V7ds0j^uHG94VhJ<Fay>-sm<2@1@!Xh;^+{|;g
z&M`qJHNg8lMhB9=S2!#eUI`K7W{VVr*B{o<{@)3tH%V;<#S{`-b~ncEqYN{OOCIqF
zI2;ibv_tZfCI=p=*y=Qd7SkDCeM5tp|D8q}W<wT~>M<!fp#k%gRiTcvA`v9_>!hwp
z4h0AcmajC4Pb<iW;F(?|0OF;}Ln!VH6u8bHiFG7zO-Y?Ph>2rU$0hs8#0cG`cqqg{
zHyet@?|!>W@okr(isoEWEv>A~E}vpa=Lwm@*Iu(2sm<0q#&-)il>HPrF`S>G@~y0$
z35~FEtt-ryix=`cwrond#rPud_zRctgjgP%&ARR$h0f4&ks0fcy9^pkUr5pQa9Ayu
z$qN`~$iY<mZy-P75A<gO0)ocTJ?-5|n@{K8bK)U)%Me^C`ts!*)E}eDDr$b=yc`OT
zXU<XK+MCayZRW9n#c6dF%9gnOEjE%X1}vP6F4KNvN6p5;oXWZex%=mwCEE3t&|k)p
zElr(z;buG)?~VH}tBivcWW~kdFv60Ke0TN9VqrYKafOft88qvh!&StB)SyBp*!{88
zJ6o=QBRICL@349Cq{P_9cQW;wclau&N6IBs^7WMPyc`VG-5hqzoDSBH3S<(2@o%Na
z;<6h~Dnlbt$Rl{NuKNWow@C4F7qISoYP$9fyJ34nwZ&PNw4_+gmh;0DxxObBxGKqS
z7Z(?qIz}m9?9cJI2gwNzIPIM;@5Z%B6SJ9+xnK8+<e8Q6h3LkWHPYz4)?9LLVq$?i
z%bwMMA8n!u>K$GTpw($i_kZZIE;hBj7vAIS=b%1mG@74iq3`b>%+{vC8ae0DkozRg
z+1$&yxi;zQq|MwRBH;10s<<gh&7GaiA0(%*AgJ>>kxNTv%#HFq@B2PEn<;;zu=v-$
zmf$YokGvO4O_$=94a$yL>Mwcs#MUYUut>s|DsClCN--?rW<DU^9<9*sbyw@o6U2+O
zywhK%TOKNL1%8V+Kun?8S5#1VzL(a{a$q>E+FKF3^efiPC*<kZY4VRtxmY~2iu;j)
z@yibQ0^-^KbBB3LMRxg<fohPRyBGto{|Y;oGJY{%3RtkQtrn7S1U0SVklf9L_^;&n
zV?DR^Db;n;TbE8RHre-r$^%No#YSn(GP7lcXJ)h`C*I)2W|ojbS2<hn+&Y21=?%*4
zbc*~&C}Sf<WY#aqF+=#p<JsD}V!r<Cc-n?f{u>w5AVMxIEcMh@VZ+DhadAs;#titu
zH2QE#<+5CG@}2Q%l2xz6{kP)>Y-u^l)rBLeQg0_X^sdGWv_8o5@H1d_4#4mLkiB(;
zcB!p>yv-1ruN~o$U=iIvZljN@JbgY+%3fJ;d-(F>X=*)cB#Mq(7zcBb*$s<$X?(mo
zgLAspiKk#)Ma_+nWHk}(ZGJ^ti}oIr&2+EC9p{E{T4=bO42w?0kwgu(B^xeB=8%h(
zddiy`*z`N4$B9$WINIf=wpS6d7h@4wbpdkL7&t<;Rl(_xgtym4c)gAoHD*F|zt^w(
zufgajj$d86mq1V5t8-JLzb9jnjBuu1S;y#baDDU2z=Xo@HDIPDb34A>*z!8zpxhxl
zS_@jAz^FXpU7?C=0$tC%RB<r^nY3C;`piJ&Vo|H-(It){7Q4ESW!?Y9-dl!M)&1?F
ziYO>0El5a9OLs_jEjp#Uy9Go_Kw#0`CEcxb*P^>Sq#O3cc=Y+d?>^_#e$V-^{lMil
znQN^v2WyTw?%y51h^XA{WN8x2mKDOQJ`;shDFp9G%yRy8Y`bf@Pu-Ao72G6me94My
zPVxjyna55wLz}N>*}4|qSqi7uRS;{jU~Y}qrlLgBQ{y|xcI>RW8QjEFwM*d0EESu8
zXk!v(RaUm-y(nz2Dt(h_hYMlYzENe543w?Qe5oz+n_{=R4v0a&QwkT<7%$+9a6+e5
zB8z027za6vx17VQtjnIm#Y9Hrw`S?px9(Y&R9uDThq5p5jH6hZ)Lo-xphnY6(ncjl
z@XyANrEz7`4E2AvJ(j#Z_PPEV|706Fzwym)c3^?|sgojX%2p)yrfrW7K_5JXB$-?d
z-$l`xBve3PcyfbPOiEm-!_&6*gPU*J*Jp<Zj0)h85~px1Apm^oWw|CO--9oytIt?%
zni{PM%1$c^fD-eo3duoK0FLHD5^VxPb}8<T*=sUSYCkGDkIiTj;{4P6;t7ex<)z*^
z#q6gxPGiS<85Z_Uuy(o}9gs5}%F_=+dG3!j*E+91^DbW_ZI!4z>u2|xD^J#aL(@Jd
zLpdN>AjQ&1fReD?0-4e|)FXY^kVGSO&0m)_e9fhC92B_nw5=|@Eb!a8!G)BI;b2Qb
zRodZ)Q;X5}mlb*0-d;uO(pf^IZkuI-@$$G?w>WH`f|5$`>(zaaaMsz(XDw7)(khU~
zW#hBAwSR4Etg@k}E)hwArw?Q!u3_vL$-HV}_mHbYWDJdUYPu|@TVYOuO|u`eMaarO
zL0)R7<mKNNflhZZ23E2enEEU{bRfF2pBuD00v-EP?3?#OGBiqWW3oPS0?aHblHr7e
zln|xTcY0~i|AzqFf=KLMS86w*#0Sk`WyMhIXdYrDs;Quc+@Ue(Wku%pstW96HsVS&
z1_<|@rC8b@&h)xW7HWPr88U=p9<0X4Am2|Ve$inirmD|kI5{Yt?+8itH$vwj=qP=)
z;fo(VNaBI(&6!&<5ZVK_?PH_SN1;6rJC+od8uGH0C59mAm?Gh1=Wd@4H)R#1gsvB5
zzq}TZ4-as(JzVNLp7fU75;iwCPcKzdiv>DM)Oy?goGhdVUgFjPCOfW;N@|xZMY4n3
zx-R9i3?7G4-65QbRCFJCie`nQ+3t#-P*%T`KahpfAw7b6p_2b<zpJqeZ@83R1!rYs
z^HmYN*vL=V<}5Idf!4y1)KvBrtZ*71Dl`b?foX`J1m(CE(;MFF)23}<ftaXMR7_Qi
z5|*bJzwXK#M5)%%WP@x_`cAxepe0gIb__orX{Zqrz1bbC=i+#(s@iV({51gU^E%s&
zA{C>BMsuZ7ifX%1&R%`%*U8Enf#DeuXp`^kF0#_}I@?3lkiX8nW(A13@GofbKj=5c
z`jW$uQ;Fy(3gh8xgpqs|bC*02gT32EufEtocN)O`Wtr^AjrUS$36x5WPIn5&flM(v
zOVd2qo7Tl=E=pA!4Ln%ia})i(5mVq{sn#7W#f&ETFZy5Zh7;1a4V9YhKh68LXuzd9
zk}k-B2+6Tr%g5r;;Knm{{^VNW3B&F{5SMi4L2y&CTa0bkBlc!RFH>gBmwaW=EXic}
z2cq*C*Xd;C^xQ^vS<A0s^u>I@Gn~PU;Hk{gE{;d}Xjc1824va%WuBvBAVie=7LOg_
zc`SY@nf`xpb?RFX<c7&<GjUYIf~>`e^<f2!#NF*DzqvZN>y5LV@y*S<oi33%B@&j-
zxx$rL&rL6hR8#BtVT7ljq*ham9oISF?8deZt*q<Q$I&}cW#mkr&<YH<h0YLxb1;5v
zLsM{2CUB21+p>kjTFtPfD(0!5JynS~7s5nM;=vl%i;`}JbPrn;+LM{8IWSHt5WhTA
zBxyIB%hOPGnk_iQN|s)lkQC<NC<XX9MsCZkb1II`JX`fIZ+cb+8-Y;|b+owVkM5{?
zsPGa?F$=>u*Fa{~e4niqu)&`stHAZwHKFG`{Dax{s2^I}Al#ZUH+}5>O{IxokkUFk
zemJz6%g^Vx!VY7SuNKPwTm6Y4&3hZ!>|58&#<|E|v8?n8V9WUL3ctIKvcXCbmHww#
z)Da-dpbb^p9?X--q5XyFo)^ml!qO<0^+Ah2@UQqea16sHeNf`BWB)Vfk=zljW{w1$
zpP$R+Jstfi&Heck*6aQI2SE>IN$;X++Xi|0|0ci0eBUoNF$R#I$h{2|`&GX9!SV$X
z0m57ytPG#Ol)m6+4`KV|zWM)ua-tWEnAO@Uau>|+-Q4|B_Kq7GD0Q`yW({8N3Lhs&
zUP%w0tdvh@fg=E+>Rp9bt>kqWUefnn^XNK-_9G=rne{5q6y%8YS&D7kWc=$*35BX-
z+~03Vf~@SgXn1L}|L(Vdwvsd}D_WU~hFl?7bTPUxu9s!yNagq{%jbuL)?~s-Oj#?!
z1_cT1G^u{djmzfgn^ic??`g&+5Oxp%NN9W21@ZeeihfII#cu#0=wBnnLp7~RtfpXz
z6nA*Nyt29_zmlNcyjEOR?x4jwIW;9$rmBD-Jv-{5Xo0A2Xb5WV8&MnkPoho#R^T@I
z{YYX&ylYQ==P${2<5Md3iwY>KHKErhur9Zi+W#Hnrl2b)1jN^Kic%?OhFlqAVP?yz
zw!)8o$k=u7tY{G{%^gV-iD-SwWYC>#w<kt5`u!;DNNIU9I&yk*8xt=Zg9(b9fGIe^
z>G~JnW};CD5Io#3#{Ak(c6m!Z$)kKXx^btBD<ZSYGs?Yb8#vp{IBirDUruE{mc*OY
zlFaYHl<Ehxt#W)~-y$>&6cN$a6(o9k(^igq`NkPIUl%4wEO(I3WkAB{&|GK&1@#u4
z-O0(usk<^hxn<DweY&F9%+tC!!5qiiv{Xd=@TDDD?f!0iT?8Gq`wY|{vsxD#EAUD;
z1CY+fej-vr4VO%$I4TGG@Q*U#=E2KP&+G_@&0T@J93(VL6$1JuEfKOe@6OQ7ukAQT
zpMBRJs>v6*U1}ea*t<GeY3?V*O0GE2xTohLvFUqOOH}RrQ@g5Ze&R~dqkSVw@leLX
zR7Am)KIOU~!F2?Cs=e>y*)*w?7ZwLw*CX`K5}udGMNP)@U2qfw``c%Or|HNeMdn18
z1_wfiR`yxjqU0lA9272X^mtrM+ilqGF2lPiy-$yZZgS{ciC2RdtWQnYF_1I+A78i(
zsY!G4p;vPOJF4*`o~FURayx}}SAJI+TMw~eGfXW{!f|ShZ_@Gr%NNG%c}iHoWf$0}
zSuT3FYBHWeDv3Q8v}5*c`&zIrB=_{5{yQE|CV=618Q~sDyH%#ur>HaY@rZO*f@nN2
z<TyFoRW6=gVRNBI<kDo3G_c;mC!_H5me=utzi`*+&|6cAUwD4?!`D=Q5hf|O_K=vW
zZ0hvlAUZU;KBalrSj9Q3jSuXnCpj4afX#GmHa=`dppb0uDgOi|ES>sE-|CeP1JDn=
zbounN?(Ea8K&)uYhz3i?2&H-VYn;)i$LV>Ivm?%?l$6+KMjV&Mt5V_C@;hdB3E24z
z6GJO&I|BHJ6EmMWB#=Kvtldb)ha|{feCTN<;K~s##_yY`PByTd5WdAL>?R;B%hPqO
zN+-aL&#Mno8S!i|N}s|saOU)xtdfLn7^!Noacj6fBCLImn%!TOi!TA_^TdZM4|RMa
z2i*56Soc;$w_8`0r<_C_%U(XY$|w6^J%5|qYOu?z_3X<|;fLAvYu$~}G;V;L$&2zU
zhQ&FT(RHU4FblkJt{#H19Vai@ROpJ0J1npB?|2G{$|nQg9Y8+&OCo=8Kkp&X^6%p0
zDvXtIcdcd3-4;tcV#RA6%yX`T@FSS!5nqIJ^*}I&{X*9Z6?Do(`zW@a+5)t%sx9w0
zZNc>%C>q$FE=wz;!CX~?tldYuMWz!~1jIVM{QGOv?5vsg`&0{B*BCU^WE&_v>{fR4
z<0?{DSTPHv%zi!wdi?-Q9HOBnd`D*%`vVihRr%#wr~PIe>lOLRK(gcDKa3-@Rhqw&
zMfWguw+cg0!v{dJN_H?div(%SssO#Z$HLu<N?rZ=sBA2Wd{P8F7{=kO`AbfUCGI{8
zeCw)Z%f@Tl{5jzu01NA0)JdPDu%QZl=7Q_ssrr~_hm|g9=D}w0fZEj)Ug66EFHhm?
z7-Mv<LAngm|DYN}_#f%lV;bnj0@B+fCWn~+LNwY-(I~uSJJ(h81~opo;f@j0&F%$B
zBM}n&*_rSeo{I{6h~$*y9FRsGI58`-=<|X^=K?H-Ji}KtTt{Q|pv$Vlq9*ghM{3t|
zFI-$@45!?e>cu<@l{m1+Y96z(O;8RwdvWEk93{_$4-e;1-@RE4I-U9|b?LIQY1rTN
zaVYv4{Mz9ISHMS%4V8e)a*LF3w^<G2Rw8PnqoJ~`YTF3*<JqG}HD)~aoR;F+4|BNQ
zHqtL>hu@KdN0fHsmPW6Sc9D+-JzPVy>eHk$4K{QvQ7jDxiwmhYUxp}c4yA=C!v9$H
z9z292_#78$r$$YE@AZY@nCu#gHoR`tt7F<>)L-#)1gyU4?cWYKvn~&+nJNum-kj*&
zV{4Wtc8XG;9|9Z8Nk;dN^iy<b@v(I51F7olloph1@-IzG(T!DVtp~?v+g6;ZO8{DX
zge2qRp|^w1uGPPszA8!|H2k%NBVHy3js%y;jRB(jb|4?L(SnAtSi}DZx^{Wnv2)^P
z@CYF$(<*1KW<%M*WORXbf+}xiCkIDAo^Qaoj~r8NHlZZeP9e){dbH^6m9!SIwJpzu
z6@xwKtOQd=!s9`aw8j_90-WgM5rxF;cFH4fq6>Nv&60sNOwCvfTcUv5{Sv>;V6A8h
z+I4|bJ24JY_`QC<G4aTf%CSuwOtRUL^4w~K$f1RS3%4rgUEahOh3GOWiIJNYpsZ16
zio-Z|^SmOq3+vcQW@d`evh;>26a9Josi17AvEjhk)Gea9F>)%0Utlvz@HZj)(w&At
zqRBFb=0aj}%O`u}-06ES347n1g!NRX6M3rUQVd&rNZ>m>B1sh^fpTn^3UXtR^Paux
zKd#=>!$QuzfM2d&92$D5AFkdBe=I3|@$&@ckgV^`Idq^k2$N>CY(*(d=J!uJ)&|M=
z4rD=|EwpVpX7u95W`;$r`5BoUNRY$X$3Sn<itTn4{0-eQlmt8)^i7B%ex@%+i&1xY
zAES96jmxLx?rSbPX$nGUPv=$g(#02@J>w`BxxIonuPyBTIBPWfZd=l*CdPfjFT}yI
zk@-5TRVAjbdZEnnJ@Y|PyNKEPbs^sakAjbndZbO-EL`*3fR$%^NxT0$l7>XqM4JFK
zcAUgM{@NYEb-B(<`y8!?)<&_WAO`B^7cJTiT}h8OdxNiDf8r|n53?@Ye{a?`>GMi&
z;NnoX0keR{n5gEE^PmkQwjP#SO>4VfaGHN#0<Tp-8DCCu1_nx}J&;z46h_s%ggUbl
zZp~^nnsTln<R4foXw702<s;O0u$vc+9i@uN1=Cq$6pd+}%&&`^T>zMyvZQ9Kg)VSX
zt9RRPRd7B{S6$Q=K=47I#4~tlXU~gPb9eF}uZj>h_?D<?iVT1yrS9n?6}|q2$GnFE
z%!Wq<*i*T=HtRhH0v?`GEO0W^YllZ+p(bsCv)xcHpAJUG1khrbrL<r3b9~j5S0WQu
zWwl1T`R4T%rHUNra)kqbElu@4d$f&4y+J7A_B#Gag{4H#IZV^$chSIQ8L#E*a+0wM
z6^)9~+j@p`<hWXc(7;UR=qu)v)o*R5_GU$uswISKu4*qY?QYp4xj*TO;7;z+8mM`T
zC}4g6S%zEiBD6YCh0<72dU&shLU+irx0qdoFdFw`pGbB4u_4MrPn=OY$Tcw|Z2a)y
zPT%`*wXZ&P^eA0AX80HqDZs`l4m8YlFTFb36DD^acy*I$A#7$6o4j0d_!nOb&Td~f
z=N7q{W+GUBRvY`4y69jm!cfrmBGR8M-A*d)2WNYYLHEVpnHki4%WY^F*)G8t6hlQH
z-X_dYLle7&ba;@`6~vPNys^VswXt6LfTrw<_v@6{IL?7y$nMQ&lW$)TTt`pqFrVZu
ztWSI(268S64@EK3bP~Ac1NZw~OT*&@vn57*@*GS}U%JF;r4v&&^SD=rsy;8j=p>J;
zGv-k^I>?|EI$7paZKy3!c$(kk?X>v0^+PA7?d<I`u~s8X@<vwU`z2#A`Jog+#pWt^
ztq1yunV==tZLv#uIQm}D*#}usck0(<(l(bNlwRbN$Zb9p`|8u4TToquc>&T63{>9k
zKk%OyOu|>4Boed(NN(6(0j;VdM_DKM!2X~xUA|`^$fe4nGe{qCaB#qLyb1ZEu>2|s
zn5E*w0mYeY#QGqPL$}C|&Nu(`Q76kvHWhNP$EoMaut93=*WWxa_Iwc$M+D+viYR20
z(nC$+Z0*GO-gf)sWk~YJ8<$dk)RVn_B~NvM!>8XzB*V0roviB>MN`?U!>gX4zlj*#
zX;zi^xYebLw`@HZa(gl@hkbou7g&=dka&ps()5IDLygiQeO*P4jO00ceEg10P&Rn!
zG9zetVf<yy#u6+1k?8C-sRYR_JY-)_YYv&Bh-;Yhlbqu1V;Dz76b$L@#0j3={CYpo
zlH~rei{mi!%1<f9YYwPsqIEfSRbtWJtVQ{&*-G9yp2WTo6p-$H`ssxD`Zr5sa`B-5
zwAwo7J9L>M-HBf5Q$<_PoHKnS(U8{BH!b~)X@Iq(2aFy55(wAGxp&&?l)mr$h@L|f
zG;sKCbMrA>F$Ni+U`62jqhO`-d;jG&x@t%M<TRsJ!QDuF!}vsMfawl5n=>H_5;1H}
z4sE!3C}92%XS$le3xAg{aa4)7`2B;Ei~s!gY`*huT^ybJb1Ob8ZdgZT_n#iwA3qsL
z-@RrHj%tgs&L3j@QwjjsVZiTd99D%8{NxW4+(Q5yV>^3B{Yz?c|C|4r^8j{OGWdVb
z4j)+Ns`VD|{Z%jk9Lft?*rf@szER%)6b9b6q4L6Kx6Sj}{i6?l0Noq^06N=w9={y%
zPq~IF2{`tD&-=gglJwqO<#=I~ZMu7jzWT`@RR#DZ6zHQvc}!z-i!oi*Glaixh@Sf!
zC-w}X;IA7e=>Ep}|IK+aq<6!E1%vW-#hK%-%n(Cysez0{!@@x?|9o&qZu@%0r+8_h
zp%9QPW3iy5$@7KOaE3Bl@*NwTT~<`VE@Kr6^WGK&@<W$r1yAcz&@(L%^5ueF;pe@x
zlq4%89t?kENKQm4oQRaG8hgotpm>#wHEBn<#%|7qEXv}n#Q?HDh0hg|%y*7xs9@R+
z@K2>CBRa7+S>3YXNM1ONE8U%0r|zK52O&Bz9~%@Il%H-0vO95C$~f?x1&&mBpy%yw
z3yJoc90j~?6Qf61sMVmD82W-sCLjCkl=;|ZydBMXnY3@(T`ZI7%aSOrDa>b{aa(F~
zKvprI9)t8-WC;`y_a5J?1*WE_K1bU=4wRHiUmhA46<8juv{(MXtl-YfP3yd3OY)X1
z+`C@Avu#K-vyC)cF8b2zIQh2Vq<+PX>DGujN1xiI-1@nOWUc7p5R0;t3#D~-;#t8;
z#uU+bXMbPj9zx!*t9mjjoNnKzZMQ59jjhofZ2k3>!A;YrVuOui8si>-%h_^9LTMLV
zyK7#M8y?|v%X%qP%556$qR=_r7Utpyy$R9lC`fxGxiOnya#20>4Xy;-_T?j8ekGH;
zLgOoG%x8r=d8Yt*zLCgH-I*;XsEX^NnOTvyD6Y%SEHln+bxYy==B!G2!iAM1=ji+|
z_dup(3h&!UhrYX%#)6#!PAq$kNVga+r$-Y#8@+SveeeUO##5&TLKxIjo{G4EFyGBF
z^n>$UhK9tgRWT~i2ekdBJj##M;cqI|%f(QoxAJGPDTgYr%sz>s4&*5&!}f`WR%Na$
z=eS=v=CE6y3-?#SpJwf57Y#Pw7>?vZc9?MI3K5;_*k#S+^0==?Kghc`cvzsT$YZDr
zCkHrAjUHxJgY8J%W>xg&s$)~7Sm2KdDd(;{_+uL9ke-xhjZqO-RGOaD57m(?*x04e
zj^U)Wjz~n#B(&K}S>U;s?fJ7~AZ=y)Ov&bNHI_5)q$#5P!l6HEa7<7Ji;Ik-@i?bc
zfh7@pA$>zq+3DuaCessJ=bKq`j!7Y7$$|cofTe*mDa~O#8*8t#{4(=g@0lI#_i*f_
zqV=MD+p`+V%N3s;u50^gYq5c0$?a|Fnf4G^gK@x)d)1E$4vP?Pn0T2#>2*X$(fdxm
z<8ozx@k=<5a;XySs|vRPM`MA97X8OPQMzd6Z!{XWchE~qD$}%gw<+k7lVbVrSR6T8
zvz{RSGion6vUiGj{eIifGW?#>r_b0A!PX>!E9ABTEoex|6L2^|xhjZot>Y@Mjn|r?
z%yELK3|%?$mNq4FsWL*ogUd>~MrxgCgLN^A%3y}-!qcrCZmgB{I3K%iX62m(TyWg(
z^^<OMwwGkwwE|x|5O&p_oI1U4iC-mo2e^MWGpGs8i`8^pG(@f7Evgd*CjqsOE{JwG
z$!*|^`aoj#Cf9jHKV5FNt_7M2-$t8hc^DRFFI~dY?x*@NKDY@6w*ytVR5#W?dk?Q+
z!gq?^4DY#IlW;&W;YosUP6R#NNvF)^^D0KhP-2|nA4wY}I9{6C*q4Gp{rJ@L`2s20
zc$3k&`qpu^tW%qq=%Te{KDcd1Xb#q-C1Hd%k}56+m3g47v9^~kETrb93;TsjDjZ`7
z8S&~>Txa>(=(NMoI|LZRhsNp!^jzI^N&KqgYv*ztQ)q>1R>bx@Iu7Q}aW}p+1jh}s
zFTNi7AeSEwI&XEuW!HXZx-D`=y)@Yc94H;lsdY7uui<{%aNfo74zU?RF1m^B5j*5P
z>fLxGRXjg9Saa$*NNIaT$3+&j=D^D7YDahGR|qP**B-t{iIXmcWzZL<)dF=<vl+-T
zC}~>Bd+Blv9E`YFD~^x*EQL$L4Z~Tp@4vIvJSmK&?J)FU%6O!3R+vFDJ61^&BoKS(
zusqQ-R}Y(OUmUt6efC5_{$ekIlyar5RqdiH@CF<cCAw>Rnag-#OT^@Js~07XC@4eS
z=wTS*H!6{}<XR$v{;e@-nFZ)Yr<Q1<)uYwp{aZr~P%&VNhh+dQm1l^)YaVGR*Fy$s
zFBO{})a!PJY0}(CRrN4gJvl*})p<!BO4S(F#>(ZiS_3OVR(RB<SOGq>Vd-GOj&pj;
zm53Y3TUJ$;m03p!FTH&>&`K=xj8=7PGKa!fxGk)p0wLHfhr0=dJf4{QSZW7ZGtndQ
z@v<LIbgs%i>06V`dMc-IZk81#$`f<NM6S5#*YC5BR+&UF+1lk9B(r+*6R@q^a_g5i
zdq-b(`)qa+z;IP39tyqJ4YMAJ^38G*D2iT~9o=gCNeBMe@ZCOrSoS<2jyJ7&N_HN9
z_u9(i<Z~+S;)^b<`ZvO{ZzoA$2IO9zq9IypNmFMHb(`upsoQ?m+#iyVBng@bcN)NF
z{wRy$`mF76;)-lD;z^~#oM5a;a^np&?mDX!u)>2C=8NnsCH9ZDBUWaZFzm`4?~Q}>
zRa4#IdfJY#Lih%m*W08XEZOyOxwZ|w71i1FO*FaUvk$hqJ8TMGhu9}34G>7n!7E?a
zZ@zXvc6#Y@5!Qa(@2$aT-y`dC5cV9qopPff2T}hZ@I?38;5|YI4SFpp;vY6Fr5skd
zq?&$ADpR4VF-d9N46+{&2?-8HXZy~<8=SqqpA~$VW>1jUAaHB3RjZ)#^s$IR*tN7p
z3ap8<V=if_r9E}RKg{79+WS2YW6=|=3R13yS7<|2oC!j^lw~bAA;^+_HFbjA?ZJ`c
zH>IU@$U%g1`&n)(C&=UfnD>g^pbRREIuEVWVE%z7z<=5S4_k1+!izt9ZQd05`%oVW
zDf!>@)(^f+;(<3L1~%kh6ksHf)swp<p#OjP4ZBy8D;XPK|Le2y%%DErm6LELAe}Y{
z?f;qag+^4shqzz$0O7BN4F-S|>pt$DLmYn)RrNk_<@;CEypR5R@i)>3-!9(GYaRcE
zJ@z;N?()h5Zt%gM7dsULQ^Y-ShS~5Z2gvJ6>VfxB<2)4OUtk6p=5t_(H-i5j;v33u
zvEfOgFGCVi??cSm>Oy7d@lBaeryq}8?Bc(^9#){<45`XTN|LvCyB`0@L1U`?PVL-T
zVSs}{3G0urbML8_J*Gz%?HMBJ<Xph4h-mu7bf}DuiAzA+Qn;Krj;`NN7hiEJ(2ZH|
zZ`QE}c#N{!+&+`ksPem=u<<8cMm@RE-?{zm;(KpCslGO*#D;|>zTB87T~p(H*$cD<
z6yvF9_1{uDSi~2nxF;A5q(W}56ZbOo_43)}<QVqKjZ&{;Rcc+rhsACmVp4o~^lQq_
z{h%=tuT>*CZHd4x&|IF=75^>2xUBpC&M(?13xA3|BulJA5oZE!%j;36OZ`=c%S+#m
zT)|*oF%d~3vN6=+Qj&KVc=v8dm(31eF*D|TjmX;@J82Wu{JhIU>4ch60YX4|3XauR
z{h+x_#(c4aZU{(F*MpDHl(Ne~+&=>r9zHLIhU#(f4J#<1re0U!2a)Om%c!J^q7;pW
zqzJQpUN1xr5m8~>E{9&m+_nsr+<6~FI!))?rAWeT*u<2ObvF+xKY$#_1Bo<(>xG0D
z`t>aOu`_4eUAeweC3=I~kJ${r;1ZV+Fj%Jq^uJ*|V2oD6)dt3$j;Z^ah#?4PXV<8E
z;^Ed@d9GS85N_rZ4xyL0eK7_^K5EfUWi(muVvl41eIdgVgPCwyZDR#;x+Np=RXc>3
zjF&*O@cT9FEXP5UXdPOWKs8EXl3JK(qpayREB+#>r?78p$n&Ee5x|gz8=qHPHFr%-
z1?I`0zLv-Qy?lM0fyD{*&&Y^3KAzmTJw7ehM{CzL7h%$JXV6!5Zb?Pmnix+H=hkol
zw2#?caQ2Ia=(v<Js_i#N7J(DJqVU-})m$sej@~AQ?W=8i`_m0F@fAL^9Rsq7ygYfT
zlaeG|FSz%H9F8H~iI;=kWkc2@C$spGr&jlFJry3te7v0hty%BoX;_mVrAA;w;c?r<
z+^&&GM;1lV2PltU<Qx!r^OKz80-~58Jv_8&aCFvNZt<7jjxRbJ#k6uh*nIB*7S9eE
zP1&4n1?qDGd7C`mZEg=QW;gnznM7Q;*+A52-Oc41(?}yTz?N3KS=T%;9QTM!bcuI9
zu2MbGRHiREfpP+p)k0>>1t;HEYHPbOnjB40qS7)S&+V2)RySig=;@)A+G>zr`<7S>
z<AQ(&aB<LRh|B1Jy2p_Yvx9b$Fc~~-WCQ*I0FHm6a}^C^H031Ln|HP4N2h(J#^DG(
zX<1Y|OA_J|18cL|s|hqzhqX|J<#dxw#w6M+fwZB|y{!E|!*k($>x?hDb@BrwO|yBs
zMT4@yEk)spN@O+`?7j(n9#q57u?J|va=)^38++Z{VFN0k*8zbx|M>TIVlHh>bHp%l
z33QHn=pGqOUg_rOJchZnZbP(}x)m|f>i8U2zA&GjgJ9|#i$g>~+Di;C!x-@9WzW63
zv`A8eZ*xaE{@><3`N_k>4l3yN;1#>J>5kde%4$n)7sb`>nG8htvuoZ<8@qcxtLGuR
z6RDg#!AkDRdUSG1*YcCkumd^g(C)J~>C&2we24N!v*#UM9~+{k0ppo7a*DLQnUK3G
zlYGZ?%fRM<y{T-n2R4uYoJ(49mAn?+Kl&>)*bD=bSw-rfLej(?|IO*jusq>PwH7Im
zkO%Bk)*!>m$~)=hN&fZqJuzL^${{UjjA{R37hPV%XQ$TL0NWLA+SVL`@4n_*t^1mp
zLDw#czeZhgM$smRd2A&TQffz+(^xf#O1&kY{{Iwg3;(z@`dB`rpPUpE96MpnH630Q
z4~GC4_yjT~di*p8>0G&zCwU(kEWvVM;)(<J_YbzKRf^G)MQIAnrC$#pZ$zLhM(*rn
z@M+&mp#v1Z0pTN%0u58%mXiP7g<G`UF0W;zCS^+Ll#piKTe_#U_{N`$ET-xzlcQ0R
z!nKDAo9U=fOtpJ-KsyrhU#7aFmw>d}(Z=flago%B3(DpEE9X2rG8m2ubQZ4P;9M;J
zeYEbYQ7gD1CD(tER$!&Wg;;UBxQ1Bz3K}|Jl#sC|d-w3zws%^zAVG3QLRH^TW6&@u
z!|ZY^VBl-DVrNMP?Tl(TJIG1!od7{S=>uedlC<|LH4rotGXLL3(UNOh7vEd>v=dQ0
z$c1);cv&jTl<dmV01Mxm@|5?L)5Vni@)x9IAc(f#MZvE5U~p0dy@(vN(Lt+~spO%Y
zvd}Y9n|e{bts~k0JyhhLXVSx-q2)nb<@>ZJB-BPWgyTWNhrolJ!tPhdnR@;m643h2
zt;Pwiq2nO2@w%J<qm}3D*~e3vD`a(HpFHmJ?bgR9dO4%c5y?3J2uO=y?O@&FR?=f7
z(oLCDgDuQPLL|+jcR2a*3j0?8kKbJPe|r2lzR<=Q7FTCF7x2b4GVk9_b0D2l1n!0=
z+o6O%5Pi?fXPJ6N^GYxd4OzhK)hof<cS>%TN!;$rGEUuP+K(QRi_yO2{j8Zu^4x{&
zDFN~4C!33&{WCj#Yio1Q7f?!99J%rL_WFT;9_yNGRfhc%PI_;=pxh+g(<`3RuLbSa
z|F95hT&sr7l{r(EkdHp+`Rs&rhQrY#oY>2BrQd=V*H?Dp!-HcgRaSX4yOk(r_Qdmz
z7~NH(vwN9NS;d!{;W*ptY-J}2&c~OlA%4``8ghxQ`n;H{)QT`|-_u24``2(d2>GPF
zjjwL5V4mg4d(C%BSi+$wQ(Aa7oM=a%+1%2Jni;@%XyYuhV3k<(dFKfBJwS(G*)t{0
z%XzFH1yCgEzVkESoa{JW8!B}`M_k(Fm6pEsy`6CtXn1_GMDICWuQa+?Hh-7)VMQ<S
zQ$V^B-o6;_mQr>RYm)x%ytbW}E?20gzx)|Le0KADq#qj*FG7I@&H;|kHBa_=rsIJ~
z9R0${sYhf+!!tZ1ao``JvTsz*YPI4ok3kMpX?hl&N920VyV-E#5b+z1VQz;f#u3JS
zzOya3u{iQsR|H}+Or37g-u{x*M{o^O!yQNC!voiD?y6(y{G5#3p3B@@^MwI%<Eg7<
zl_w{s@1(6raeMGi658~0Cf9Zd`Ubq6S`}g>HOs&CO4N7j(07S6UwbT;>g6<<IOE6F
z>Je2Gs6{?GEOxUlAw+H=FK${>7JDj#5pgbNyg(!Av*BatlE=8);)NrEeTop04sJ)_
zG7p>t$F8AXa%Qw{jtt!>)CYixzO~Rl-4F}`4aL`2aLvzxPj3@=UJq8G4ajY$7e;Rj
zn2B*3`duopHMWVn%dUQ<xV!zG1>k}luh1R;aqNV~*?n^27ZCBf5`5R?0Fe_(#2)KZ
z@a?Cf*Uv<cg;xt|=>vGF6ddXSiKI3nkMYtYb_&`>zz&fqleEgMv!x!_Q&y(0S6uAf
zNe_v5y*lFAmET9GkPW2z*t{)Td&^j;C46b$qKVCD{6umQ-5jtd3KP{;b$bXMd|2a@
z?8h65z>UkP;Ly5tpzCUSpcRq6m1eQ%RPb3{--^Hzv0Iz8Y!Zl`nK9YQ=}^|H9#jJo
zA<&%+WJX4zw?<O36y-}M*o$9sc}{9}z7Q~KC)Ug^-MJih$2S|}yJh!=|JKurFCL)}
z%Q>Ub6&Wp7iyL8IDpp<nIX(zf*h4(Q9{DJ@VRqIgbNTn~evibfVDacRDO&=u0f=YB
zqv}jzEf#_`v+r^cNE1bRV~yjw=~mB4B|QsSp3vW0*-#I}QRnKKtg>&sH!S*piFPJC
zkzOFd0t#w9azT%o0wN2#_%vez6hCL;^0+S2ne_B<nvkOUCn(QU8xA}k8pa<n7Yj6&
ztLD@SLrp-Uu;ax1T>$^;Bg%^-hk~M9lR*3UU?x<OfNUf#$<vKBi?_cFCgK?~0Dq=R
zooId|7_Te7SAl?M@wyL&jgue>Z;3|;0+3RiwlaI-ZF|d-1g!f+ZZp__Kw;pchYbr<
zPF8%@uY3&u@*+Mj2GEgI9g(2d-x$yZ06i|)zrQd)_^SV*^ZGA+Tr2RAk*$jYg=+o`
zNrvh^{`JLL4V<9W<>e*z6IhC8zsp7UVo)up7jjj!(%^p~-nRhag@Q%=8}aS{sjiSl
zPTAkFoA)x=_m6=YfP2OIuUVl5j$IuJ{I<6KP+4LCfRp<D!t+0~%KNnuIJVn^n)!Du
zuJZHu3*`^I`G5bh?&t3cNY^R<F9S>wdD@==W}I@`fS1%N^HaQb2cuk^drSj6)tvDr
z&#Zwcv&MOaZ#O?LA&}e)0n;;s7Ku~5v;ns+3M>KVh?8}`O@5(?5n;uDVlPZ1q}F$K
z9o;lELk&}qMA_R~o=yuoT)PBE7Sqm88_d>=60D~gwSR0Ve`g9Ss44zt-P3c9{nBYs
z=!nkYnICWJwQ-L(XZJxT<?--wCOFa_l5kVEfO|YI>z-@D%VrzL<*=d&iL%VDjqDlv
zAUwUQrf1?ps;{Rvcmf`AJ6a_E^?jb9gzAy@EC}RA_4Kb*#8z0CrkceSI%3&Nf0>)h
z_{G*Xeq4XHSI%97;>>Z3ijFPv>YJTu_A_c~qH9Aj9v-z>TKfTB8`FvyoQ5NA(35Td
zr;zBO*c?jv*(R#Qphhvkq#&3avH?W8DrK-@%;Q<a`YKw^bPA-1II&u0WDRZe6aXPG
zKu&EOYYrt-A#zURH4t748kPT$;}*~gWL4Teg>0M?18FKZL}B%DPLW4(2jWN?0Znho
zh-e_GWzoI*-OkQL!|S7kLzOm~b5I47=r1?N4ha!{{q3Lm@P1DsTG`o=$iL$@IB^)h
z3&b3W%QVy*(%-WT^3L={R2sF)J&&0(&~F88d8I1mpN{73ikaOW4@Vr&RzF0$zJ<+G
zDZ%MeKXXjFuDrZv^f;Ypow;e)fRXeAoQzspIZ3fb&xa6PP^HV>(1s`yb0!Ek7s;5Y
zve(qq4z3UI<V~gO7w}?V&R-B)Dje!M-3C3*3+s+P$m-d_zVm2)$8Jv^)u>W4I^$%%
zrI>z}v?GM6yKLO6)C3YeLs?nb;C(tC(N&kh(a^`o%s?5z9aASXyKE*8e{y5>q`=J*
z+Py}HvS8L#KC{Q3pPf0C02e#H2^H9^4lUykWNmkm6WgEb$a_+3@4gLk%F(%9yV=5%
zyDOA5f#l!d(QEnP{`&G)<3l4R1k1ZaJd?Hs@8XVNa2u^+vE^wj3j^UPE#cWxLo&4>
z(|HXYMpN{l*RjU|T{{E~TBJG*ln1c-8q@s!OqxWPg(5C1^fnaZeI}8oI6Tr7kFImW
zwaD$~hQ4_Tof--96i(_RQnRAkM_yXp(N3k8XTvlc=_#4077zmV#^<$?sch<VI1{nh
zN+;QDGvfpEcJC>`2Wde{h2#W0*I|l`)$aWE_)i~Sn_OU2(Dqsw=*t#Gofw-9D56D!
z`78k`_d0Dy-cf;f-k@jF=3BX{B^^PaAE*O?*g+v`41=9!p59Z{+oHwtz_xc-(vG&S
z{u9SmwweC<_aS@;K=C3EF9q9Ue5kB^FJ)7l5YwNPN~JlHB9c1Y!>-AkLnN{%GRxs4
zFZU40i!oa_D34th5;W^RNI{ewMG~Lce@f-RggT_!Se{*5HKIK_FZ`N5%6ETjSKZGJ
zdng^DrffmIf$Y<1V#pv(%kSE(Mf|<ru{^irBDwK_yNd_lcXY&+z0rzikIeP9Bv-AZ
z>{ag#5T_F};~px(>hriEH&L!gy8!HtjoP%SpIC1@HJig`)nbL=`(mFN3!}y(?mYy@
z;)v$@&A$>(_UkP8hGtX1K`l+KSI+QJm}weXq1(PtF!;gc?cI}bBe;_Mr=rAsHtm%B
zoo!tKQN>3h5{w`G`$GLrQXiuxgRqyfD_lp|E<Qi6JN-hiR)27xts1a)TcMPQYJl?O
zwTnPZ@H+z+>9tmsZ{X%7hs*P~$8!)aqk)nm99@?#bqnhWaujb6xJkK2E~!fIR_-oD
z%pb48NpN*{BnLwhcgT;FYaE12JA<J^!(Sg)riIHFk;Ih9;c!5&uu@g6+2<pVhx~cK
z&O|IYPa(xv_el=D3HXcv06km|xJ^bh;vP<i`tG6gBCQSw(IiX|v`67>nvnQweOJ?W
zn3raHKw4_wO_mW2^zVo<nFml^v23aDF7&G+X=8B-I6{-Ok<_^Co%f^cjkgy;;5b~5
z%GE)YRbH&w`?%D4W2dSFWs%tXxYSG_E>*!{_;}SclZV<264du;BY17vP-9l8-;1cP
z<1%rD5#*$CA*Xq{!g=p?Op`jvC#N;?`^dB*Qn{QjT*l4`%@b~-@ICWQ5-<9KQk;~4
zKx|QTSZ`QpIq}`F=17tKBN7UIWp1$WTi?kKW(GHQy?T7dSQzK@&*EFHi|6o2a;ShT
zhzS+jnl|lh5%}Do@2Ek#v}tpQrI*n!{GUYHa3)imJjtP2PnWdVjJwW!p1)~1CDhuQ
zt9xO!R)s-#U=yfs(D6R+(X1b9IZw=8w#%~h3V{>#DFcz3jF=+QZFs<_-dhTXklCft
z?#NWK38Gr3tG6KtlLf;hQhJBq=S=YNe?980$e`WCp=D0wvQkxRG)du%v!tWl#>_N2
z$w#AcIZ>su33XXHsReQGx;EWap~F5=DN<W*u}~L9Kd0Y>s~|A$Ir6nO6E_os&o)hu
zWzK)4BSl4ZO>b{12T71#qFz?f1$SZeU#6O|V3L(_SN9XeFE?rBt(nT}l*DGd++@Uz
zYFOSfJDk)%9K0y8g6w!8Z$vr7`2nG*d(Sf8;XNLuQqNW@FNbkfBZfBIeGhbx{l*YR
zp$Ymp7%C(HiRUSh*`zPGFkU_1<&!Y&L=7W-NYMiL+o_|@I_zD+6FW22%pK0$K;zYd
zET8OVTXb6=jYS>VNz~7I;G@-8OKbTWGvl~RKF`4VI1!$*4Ni0{NlLbmWvq~gzk*KR
ze@%RDw9ON<l59Z#sc@1~(sR_o+(K!GU4nZq31@4yTZcm2nPJuGF;afe0ywNepTkDr
z%co)EF|eV{fTkzNH&~$;ucU0Xc&M;sU9mMQaOl`r)a8dxa^x)^VVi69S?gnN6U)Le
z^^m57j<OTXrlWeczNvoc?K?#s+XJ2?P%j2U5k9Nkp5oXCAccl_L`pYH12opdzZ<eY
z{nk0C;&`c&8pXQ|%d;l`dwdi$1o76684&bmM}$QysENEQXf;z+9WbacM!!p8w*Fey
zYHDPOnfP+Nyf<#W+B?*^Q>{J&h$JQS#E)>|>ctxcYGW~NYxa2IR`$%!qJr;3E)3{2
z`jRTfDlO0hMeC(N(Pr``$v)2BVW*Wu2d{n?eu3u>O=~OUvF5XlL^Ax;euVt^{9^7E
zMoG<T%>vQMFuw@F_g%H)p_MuOWw%p?{Yp)8&P=pA6w>dp#_Oned2B`d0^Z!`m(sI!
zrbD>JX79ikQjhQROSNZJ2f=MGjWKw%2C^zPVf_}US1N!2)92NOr~cVd<2KtZOES$X
zA!SO+5-)Nm*O-MwDz>-fsp9=&dvBhj_7OysddyZQciV2fBXN-LlDHhhQJZdxBwu+;
zx&C$zBjAP9Ln`YS6f$xLPEIkV?=3slZf5~B6x8edPre3ZSZjHFi7;7cStnH35%7D$
zWNa2X#->tshT~+!YpGCOLgK;SD6kDUL*MRV%N4votXG#K++CYAkL-#4*hjL)$KZL}
z+-a>ojDYSo8@;SU40{m^#FG*eVaY{L9xsvLjud)1VEs;Okja5o{5}<5iZ;w|pTAaH
z<S&6mq1AZxdUWAUIgn2}ykrhz)EW&p^2HQn0JBQsR^tg1-e|uw9<*^r4KqSP?@RLH
z9x2|;Fxr?hYbk63F+b{qK7wmGn!85d)_jh4z|M@pN~vM!dLOxGdXN3DH&fzq3zc9W
zO*6}wIyRmhiG_QjyG!t|EGnV)j+=1QbT9B}?nSqlJ^T?;I<pm_4HzGHB=-9?CHb@a
zmq#5?a@}PV>>I1ySOKKi5$X||#7;tT*JPE_RN&8hfD@%Z-n4g>G7xU4HP%km*Ydp|
zqnTb>C<r>%cW-GW#~`|g{GvxFX-BfcUQ30BAOQ3I_(0rvAegDft!#Ep75n$ZyhDQG
zNcYH|0K)=FH#ag@vr&n?i#jOt8~SZWWH$#)r^DzD^A7HkST=TRB*E%p;h<Q>3&0Gy
zb+KP=iQ&Gmx5P&?X&qNp8=An=CY8IzsY=;9>;yG5n0vIDp4u>K=CJD$%e&G_*fQJ4
zNGl-T1Thald5lC<4{@F8vv;{sT7h1l<$O{2M<wOeO!}(q4#tz+&#%Wl#~}s32-fN&
z(44_&lcU9qy<|sL7{EAzF21JL&;0(ts&`IMhf2>ecVU;mf5;yRiRN|5utvzYmD#yS
z0nChy1pfhd_QKzXK^toSFhr^&{*AxxjgCU*Y$Jaqio){&Q0o<fugPC>L0N!x!>(AB
zvHSy#-oOG#%ZCvy?{~%}Fgl_8Af1sY{)Ru$?dvN5Xdw*C<dFV`%nx8+0Q6<HtQz9U
zU&1h-=T<bIT-w{)G1|?oein^>z}MHz&`?lN@JC;K535EH_#dJFnL2<af_r$Q71#Q?
zR^xNp^FKp-@K6o-Q1h_2?0-J<{d)}{Aav?6(X)SuS%9Z376h&p<KLFa3147z8gKrO
zzhU5qh5E2KA-GDsdn3Sf-nzT=oy7^_*7Ye1qaoz>N)uE5XT>AM30c|Ig5AB*^-b5Q
z!;Y$4>6X^AWyXrD3ea72w8K}U+Kg!)6k!PY(sZiAr4$pu!q*`?QyT}yYGU~b9$^MF
z)9}ak(zI&k5krGn*6%uKza4+8w_nrUK|}Q7y8v=SUC=JlJj>h|*x1<zfnIWlef{$U
z*f&k{T>(c@$=?MUop+t->DYql>FGCw#PYa;1XX@N`Ng4vLfumj6Y4Sexbi|8^gXCs
zns*5p*9T_p60Zt@&CFQ%ky)9AK`u896A{+{o2baUZxs47(&Aiqk4TbZbMrnIS0Fh%
zDho<ws;=b98H`C{GwrglyOYP6$iEggr0p0!%dZ^9q(#iQ_c87X(K}mtB2ubD0b6<F
zi_Sv>Lai6b(Ot%y8J-N{fJa;xlU8=(LL^ey(_GbsRImfkC%g{o2`jxvkK|ljJ?fPi
zU0f^mD-f#4o|?FrFSu)U4b3|L1da%XeLciYy$6VtW}jYl!=^jEEdazc7#eFHWv`Wo
z8x7@|W+=D{D^;)#z}2q)qj{1VwJHI9Y?g?bSVf4b2+5z)RUfXZ*zI*j%*!ztVGW;8
z7Ll&)%`-K;a$ZTuqAoYp%Qqyg<vac~Colkev}AOD8BcFV@uP=sQ89Cb+HCCD=~WXg
zKt<S+cyrOUQrF!HH;Yxb!ew)AAyDpOL-7nsIi@Rm02pL+*5ffzuYfwa9Jd>-zD*$8
zGT~&(SBO1LuIC+aFcs8wsm#=3+0Vv5@5?67zPsAQJ3j4w$L>NPH=CZOW$a?lYiI(>
zF1<*a>bJy!dgFS7Csv&#VNpmk(%{VHV!F^WW&F!=#=FpnGT}+8ej=M3vLkJISD(N)
zAS|0sal6LeReX4PBRpDi9Oj}{N%<*@MzttBLt0X*!E;U$IX?D48;o2QG~+{>$DXOF
z&R2Lld!oR+zt3qCw*{@3(ycF^&nOH7gM9>e1uaG$${uaY>%rT*uB(aZXDb>@BVE2T
zqBT+El6l%LdUTi3gop<ke-`bSy!BQR*#F1Ayv<^p*;hI~$N~tG$j|t*b+}xk_wk`0
z1aB~dSaRI89U^e`+@~4S4&0|f>T=H{V;W=n1>16t;<CbO(J?8*@uUzM{rkr3^K(;A
zHH7<zb32u>huJ#ZZ_)OzT$~4+)(aGLAVuJ8l#uZVkkQfrrA>qTPmm}TY?8ZFh0C2@
zIgOO4IGqGMRjcx=fQr5)AD8M_c4rK0T%}nAd(j<iXh3!m8}x#Z36NL_@tRSwDxAUM
zbCuQ{F>Lv#zX|fgfKi-=tPlY8J^z9Ff+|1Ct=e#pG+HR2z;qKjfQ=kDmjZ#d8urGb
zO-&pL*heyD21}6<jYTTE-Hh=KA9P)+2AH1ZtWtg|AZ5nof+A;N3lB%Em!R=T>@3@4
zJTy8sPon4)F@z7bt1Qx@9<Ld@rfRA`MT<OqojP1ZN<75D?=m<O(9#*n^|i?yQFhaF
zhbyafZ9V<T;Nh9DY!`~f@ou;IS}AdPp>BFy`S)a^97!34OJ7}qwhxm^U*O_^sLq&R
zgM08t$wQTihEc_!>G_cqVOu=S7%?gMO|%-0Lty!W+j4-g(KA<y>5+oeDV_Pvpku-&
zNh9XHq0_CNvZD=^$YZ`Dhhv-|8RRHJ_5ndHNa?WYqq^a#P|b|nf^Eu&l$KaaQ{3Gx
zM>>fwM^e_${a9`?2^bekLPj!N-iskM*-#Hy@v9nSu}4Qnc3Hk*8J!*|x0aT9cRCGb
z5BU99spf}b8Ag3(ms#M}wex%u&mr)#(mba-Y<F!Cm6$+R$I~}K-hGvI4@3z*$Qt6B
z&au1r+{H}zMROgw(PXtJrv`nFWVUY|&QzF|8ImRe5R#5Ay#_Y<^iw8G;Sfo>oLl|+
zFG=GlY9qOP8rY*UnuAiorbCOiqz7k4J+%PpOY(;5mffg%Jz9j1#IgxpqbS6vZ#U9Z
zj>$Dw7zX(7sPJw2TX!nV3__3G(1KOu#Nx0E%$1s+bbQMKkxM&LC{4vre_i=Lymg#n
z8MN}b_Q~w%WQL!3ZCzf*@h7TXurnnBH4l7=H0DZ@J%&B?I?Oa_CnFV2L@*FfE;@~v
zn6a<8FK=mnh_Sx6#<#dLbiMxNokCJ;y-`$Z&_1|)Yt>z(KEKI)PMD{Vx#7ZJ>A0ul
zQMq{WuSc&J2kF8(o(Pi|3%!;nJIzRa(GRS5(zu-GIo&~^M>Y{pzNm!)sy4W@cBmgo
zZ&|06W%A@Pjh5?-6<LiL`j}B*P}>nu*$NPoF3icMM|*ReU}^{d78rn;)a?hD$%Eb$
zyGpAuB>iXrJcRm_9<=7jLNEp+&$p?B++PPIDpmGI7NPd6q#hN+$(m?E*JdWxqUDE2
zne%)tDQDYtI_OsD0jNpqkUaVg-Ak89#_?;df#W6o&qySPn8d+kFn~ycX}izz4I!(K
zV=Q)~QjiP9G+6K@c;XtS!}Qn!FC)r-u=Pu0LRoZ??C4?R@#q~wmWZawVx7YDhF+_F
z#TQ61P2Y)13DU2<RFz~3{{n>gjxj>pu8*`*C1-bPhGy2|vs*nE+e%O5RfWWT)F{a`
zA9w*QTQ8`F7*o`g8$UB#ulTA@**1bu2le&WakbSF=C|!`C5eszGxRAdNQ-jVmD!Sn
zITITNg?z4st3z+4ETYDs$!vnZ%(>FzyPs~K@t8v^GKmhuxsPn%<bLmVJbHYAeqZF+
zea<NH3e6y`Bd3{)WrUQoK5w*IVQWPGAk0pR2vV+^F101e(lCar&oU!z2`0$fvJL15
zl#~TynXQyfn;N=Sw93M`9Xg)0Ov8wjMb$P^qb+IgJ}H-lulPObO?ZHK+(fzhGeUOm
zFm9FNsJTmHHo*>(u=t>eTFs-*yhm=ovMj#3zp}a&!%1Avd{273ErQQI4Y{^dpGUO&
z82v1qi5!28RUm-w+GW+D_UlE{;!~zLrY}21mz~lz(p=8uLIum@+9tmG^lUj2XZ&^y
z)N^h<|1f?e9_`60@4Bh3PGF>muY<30JnKkTRGJxe@>VNmE?r!U$yg&o1O*}_YU6&8
zei%fFQR9yvM}c}t%a+A-Nj3H9V)ck4LIKv#0gq##mPB?lx~<-u*P4Di@XP0?8yeG>
zY8-k4b2^eSJxQCxVl`KewmWN)Kvq9c&x+gtPa3#}Bre-Z9ot1?7!VlMvSvR=j@{i>
zQtF~N)j<8UeB~%(DU_Ps!nSc<8@EdntH;WxCH#~dZ>%9Wu7ZqztCW+k%D{fJ3sF*{
zs+sI}^_>h#yfQwDZ);?b@$PNDkRe9w@E!G}wLefKN}nruX=OB_>0)q5m1JMg=WHdf
z*$mj;#8RoMg(MQiZJiw|SzT;gWD8nd%lagw)4-rRk|O4y5d^^V*ZsJ`>4ObU(5@EC
zPUhPP0{{nm=0@rXIaul!7H82Czr9l*4(*vrr1h**zJdGBgb=2s_t4b%9=6TlfLkOC
z%HT}t!stQ5T<v%uOb2=D^l$im3ktR<IiN=oWj&=cFeejUvl}eI=T`KnlHNWQScZr2
zSucXo4i9SU7S=wj$R9d5Qa;B(j_2kC;r-@%&H}%VeRoESz>z{J%f&Zon!f5%9jBN6
z))Tlc&FN~rlS#S5P2&*D!Nwj<2%{uzb84Pw*}GPdbSHIXH1x0(DmV!A?Z##)A@82N
z%RHP32L_cfpy~8!>WKoK5{UFUTM1O8Gf~?&IXN57<&WqIZK<i>Km7xu1e4$Q-tM36
z<2wQ1_*tHM60>iDjH%1*!QzY6MXF0_D@zmDZ_bw0Y4X33g_n*P?`_=TKiu7@l?zi*
z0Vy6j2xqH=fHlZ=dwKE?@=19PyYblYn-A)<RGsR_e<6{tKEi-r@tY}#6Zy|kG;#om
z3FfiMVEz6ypb_hL0J3m9nFo?V{lG%^!b&ef0J4;cFu_p#<zGO;1C)|5MUn>s|6JWG
znGE2?7`bb_`hUwTfryxkg$nW{*gsrYAlk$A<{U`@0RioqCue_&H+A@5y?XWa&4B7_
zZ^-!g_#0js**{~uXU4vMu61`#`<Gb`4!8=8e|K&KIKJlzr>g<Of5rjyy9NfQ`rsSE
zp9y&X-W>p$Q_*B%f0Ug7K)a7&eF*&*^nCzzdXF--l3xGjbnf5xE6^q)`|)#}KbZ9a
z>_jwh?7t3B>dv4{r0hytNJywrU#Np@XzPY-qqEKEWPc=6IkE{LA=ubiS6mA!BIM?-
zfL&*KFIAq#(10pNys=i%oFLF-QJh3wBUdxi=6I+%xcp3>wE`he=P1tAUgti+YiR#v
zjv2Xhp2|bdf=x~9pJb@a$Wycb)!tWzMYY9yd$2%+Q3MeMM!G?|TSB@+N~F8HR2rn4
zp=)3$Vdzvsq@_zhU|?VX5g5AO&GC5TzHvXi_qpHhe4OXmd+oJmp1s!p|Esz~ic+54
zn|gyG`KbI<!n%fu*jS6Pxh4G7rT(+jO=0FoarXYVeAytWW0(jbsBy+l=EV+oLq?)#
z1ndyWtC@^tA!SfdMPU~mr})ItzSw+sT$|fYW%a1H%5$ETkJKR$*loV_&dM)eVuRBj
z8yJ9+yMJX*l6PUlx=}v7jeT{`Af|BbXx07LaBpA0`c%tY{>f}+&o)q0YCXRjn1%}t
zSf?9>N_^eal>yGXFRoER^HpEVJhr*Rn_UK;Z)B=(z`r{IfQ%eAN3JlPdSZF^s#%*^
zgG^q!PPHU}^XbF3|LgxBM)Y<W+Nz=GO?`gPrIZ8qQL)w8?NR@HU6gHJ!SIKHnn26(
ze#Wtb{Av4pRF3oRf>g~P51I*y*xURH(7SN;p(3wau{y<_h}HCi6t+s+;efT?Rk=|D
z*bjrm0SSZr%!wa4ic;wOl`#etVyo*QZglZMPQ(raTpFh+$(coT3wKRn>BI%W&BzjF
zsJM*iggA}~XSC8{opw$@yz46uGp$*=s4lx>UuoJ;zIKUwt-+OFdfo~>7)kA<rY>ef
zBb#LEh9{Otp=(RGm+>Gf3f7A_J{r41t!hIFhfkc@7THMnyk3mG;HR_Gt@*)%v`(;S
z5jr7S*5(`usBnG%TSH)e<J|!<+4j5A^ONMncq=ao&WH|d%l={ZO0`VOO<hCiCE{4?
z{2vg<?f(>UL~!`J_6lhqyA2V&c2t;|AcUDw`&6ShJs;pu^o8dV^qFW%8-JUcy|BL?
z7tRl`O_~Lrs7UJVwPyu)USi0n5y>fQJ{WZX4rElc5~nyPuY~|$Qpt3maAB6F@zVK3
z3FtneH^ZZp9WD8q1y4W#TRFC2yuCl+yt}Q&r1aWyr}r5&!I_IbXx?47=*Go}T#Nlu
zt6mQ7MH)vC;&23Lv94#U(wC}Cv7yDHxJH=^D_yZRg&ag@b@1}~TEGKY30o0aESlE&
z)m~9BZ}O60XKOKWJ`U<5X5Y$?-n;y{bId+Xf@}56{k!g_KvqLG);yDP&f#(wpYjY}
z!dm;y_5MM%{3e#>;nwS%g}QUPgd4xk8~6qow+AG5qz%~4koEfLa$di$hCdYdd^);_
z*=kt5@XNi4wsf;JHU%X|5^XdrhRvwp!D!!<kp7Ymig*_r5buP0gl--AT1@YkB3<rc
z^=YS5fic{lP#NF+Q4fIiH<e3pR%c2W`uzd_FU&HnCpQJJ<zOIAugIc0jPl(!oC;#0
zT4>>{TGzz;ft|AqrRc=91wDe`Dh0CXJ8$=JQXztchr@tS&cYtu?E~fG{{*>&h~3h0
zNS*_bO9v@Kf7Gp8r?e`h3K5y^n>Ap;V%*+%XH7fIMN+~FI&!v;<yCl21|`opON`@L
zBJKwE5{kkhQ+5xx`VF7~Dcng^6TLH?&~UCo>veGjSS2wDN!>R#XU<QEznWjv&&yEm
z5|btZ;hBpy+NClm>;s8?kV>Q3vSWUco?x7LBFi^;I%H@?+$<jOtq~<jg@McJ4mwqz
z^lek^_$MW&AdkYIBsr(IEFxtV7rgslKPVf4ForGLScsf_mU-{{ph;Cw71A(vh^?pS
z6M9km8sduePeb+=^;1>|i;boAIn)o|rvU*s0pLzDhxb*6w<T`6E;7y#m=4e@++Fj^
zSe<-t+Io)9S@LqoTcOEu{zKA-%Q)MZ=73A85<7<ZfOnJ|N5$HAQjwJIn0U`a97nWA
z$hXIGWD^Y|JKyxul-T&DsS8!goR}<cd_B0}j+RMa%pT4!CnV!tN+3flBA&~-5^Jmh
znQTh0cb5!(%s+J?3n`<V&#PRc>KTWKHtVA@cR!De!d$6RPbTzT6q0=ioBSWEgOvIt
zpRqU7I4zdEk}*strzqGGob}%)=2s*`$|*c^S^ym?#O&DjB;|E^2_ueQM=d}4qN-eh
zVv-NKi3n$@pae5%Nu4N4BtxWbELE{yr=`tewBh%hOJgSAe5!bS{{%p0W5Bm@qs~1m
z@KX4B%-v67oKW8&*Be!8KXb0O&vPXUCZhs=7^&8n?Ust_6&f|e&;)+<3Jy)HRQoL&
zUwrvXzRUp7sd-lnT&<;wMsTEvPH*9rbrHmyEVqn0wmgXj)JQX2wnW%HHI#RxI>KJW
zfxQ?NBq*aWWiefftoTY`r479ku|6ibX)x$JBUcwACYU;wjk^bn3zv=Y_EXyHy#4n+
zF7gSB((EPZqLT5Gh7i%zj0gH|^H(^K2jT`)y?IR#mD|pg+!;|H06>)!#@*m0>*DKP
zyHa)j#$r+sp&Re`y=fFlwoFyh6B%zXjwFe!DG6_m+I!7T;h9^1SW-OmrFuwix5Aeu
zg@!9M0r{cnR4z?2y^;pU#azoj^Q^9i`D~3M!m3iMFY7C|a?ht~!HueVS_hs8?~aZV
zgY{dm@+8BfFIJ&pQ#VYhn-KFQ)~1UheC-&mevO|u<YZ{<qVVXg?EyS>S)G#*u;j(3
z`$U&hp`s0TL=r8QqSSKAPN@o4*X2KLOcTa&V-uN9$VI}_lMz2w3OWj06=o!jL7&34
z2rB3_`sX#V29(Z~(@j_zG-l_eY-TIXym_Pj`NsXs9hf<LAv+J9#iHZUe+{N4anpN9
zGTmaQV2|_UD(-KK3uN)jZtdGo4C|`2sJ?ToQ+y`pI%vgpKD3XH(k@O&+P#iT5bbE-
zvtgJ6^C%xF`}B)C@bS?l0Q=J#9kkNZV@%eMUW*+}Eyd=|KTh>GYg+@_YW$WequZHj
z%yAa&T5{^kN{m*nhu-lh)haRzE5P3-mFY5(5-7??Uv#8tX&suN#`6lMlR%-h?~y+-
zh&TyG%HJ%lEE?l>$Az{7=&KByRV!Xp0kw7?kusr~UmYJLO<<TCj2)#>M9#sq$pM-V
zFa1U!^U2Gxsc(VRArbJmSt6(6@oAD7R(x=4`L7?Df^y6`C_kgywB@hdt>5iDowFRv
z+nMU+58+98YGA+uI^Wh)29kT$C0sCihvtd59E6S^tFstL_A3mkzTLP1ZrN9{7DzXa
zp%>FKy-08LmhXIx3I?onI9X4Z8U$smU2SzCbEN2J^2XVP9(tgi4sxO&k9r&+m8Zjl
zR&K*!KXA5CDax`_323z8cei<5bca_7A*yydNX-UOaBq1geP#=S+y3R#KFI|RY35M?
zXs99Achl&XKTDQ0-v1TQ?UVh>gZ_3TCV5Kk(=G;gExj9N6t0$xGcgpetM75peV`je
zWHg^sOE?NM_@pOuNr{nsTLRsO&`XX$sn!G`wZK_}Y3;&zcw0Y1QFL@pcch-!k1jVb
zeBNU&&C~`-vo8}ise2lQ#D{nG^-k0CB~EZH94fL3vNI`akK?{xI&sZv*|1<P)5yC4
zEtNF?^1zVtT;*M+aPkRF!g97{$~DUEaF%@z9M+izjYPKC<gl;o_c?a_u*be0+|(x*
z?XdE~oldAFzMq!KtgDD!b4XuX8*joC1b13`$q}{0DTE9aFZRHQ#uTZj5Y#Cy-B*4)
z!T*3COj2w*b#juddlJm6Zv;4vnO1nD2McsG);oJ)dg+}NvNvv%kfa|narmz%unWw!
z+FYk!SQN{2`nEQj4;l5lg<V6e<N!&3JVt&od;}sf-)sBzzyAJ-#-5BC2+H<C0><Y~
z?WmR84}&|6f2<qh*-DWrJp7Bxr=RpP%`$awLddD*IH9K)i&fPFqmM@)&;BAsw#oQa
z*wJb8TuiqpY5Kl0>KxivOCK^h$_82=e^+2HEEt|yPQz~)soNxmT^pnXCdD{FB=?=l
z5zA_8r#Pnp&_J7XKi6PJy!HAtA3^VmA$6*R9LHNZp<|aNUsBWoBIesLCHtBV5U=i6
z>{%1${e9R;P5!<+hgJKe3e)`vRrfPSEZ@XQsrwMN;*D)r-gca0lohE^@J6~@#;VvJ
zy{3|IvTDo_Wt<ze;6dSztLp;TC|$&FFEI8IHde_)xJHs0KbMKJmX5p<9?)HW&vr7H
zZp4Sy2yB(Z1Ctx5gklqQ?8SG>s2t2P+IAYzQ6D^+tLCjP(^1FS9{e8qoQ?PyOp_m$
zBG|!lWGvmn55nR2o@Ki|>RV$>;dAKhMxay4i>5rQF=?fD!kdura;?YxRiG=KVwQX#
z;>M!z3ORY$9Qp;{taoQts_0fQ5GAaf^w5r9grY?^i~3XQj^kEW`ao|Js(ZmHhGTzS
z0?p6QL+M)a;fA=WCtiLgMAEi@rI>y;axxy<I8X6-=q3a-3|Cz#8fv}doqY|4q>#o4
zbNW2R8t$^>iY5`LbVce2m#baSA14QWX@|G(R(V(Us|P(>|BWEify*V?OSr9WngOoE
zmXG;dNcC2d2lqwQ$Bq_v7Czddn?@=&PtkOA`(Es^BCB`HDobKK8WVfq6ShD1Oax|k
zb?IfPz9eNo4R5rnc*-V_nc2<gOh_XIf0_`85Y*0l`5=&7;el;lWi(f3CPK69JniQ_
zyOI!tUpd$S=l7M_=oUT%PxPP01vEk3Fi#Oa4wY$jj%aqSMXmp+!A+bnFi;I5PM<nj
zQi)CLsp{c29oc!=Ys3^kz;>q5HSE{8`z1%#HEpGIr}s#8<2h`=p`wj3B3&Fn#Gz3^
z`x@}6>U9&0m<Qq4+-ko?(r=z_+RDb)3HIAJF3;QeHlMSneQ%lx?%MlP^S@HWSp53<
zbd8vEyB>g&Z3Ml8hK~lVSbWTq)oJ3If8czw5LGF+XHr<W!iBx7_>`VG=HYKF8JR55
zCd)LpJ_G>I;pI60TUGs05ARv*cgB)O-y5HY_5NvgT)XjJ27povnSwq4*w4NZ1*-hV
zdD%+xfBFW`=mFR`w}u#n^9P2$b!iF`9VEv2=YAgx0R%T<+Od%PPlw=908r11KE5+{
zh47mT&~rH~d$Z@REW$mEfk5TK$;rvKI-DPW{TZe+NJK>BjbTQ$(s^Qop?Ox$pKGpR
zxRPaE$i@L=WNa0Dj6c^reH9K2%ETu9uNe3eHO2<!(D>>(+0`4=0CSxt_jmp?)oXt>
zUJ{D2CI7o`C=!F0Muub_N|QfX>#A-vM^@~{yX+Q}dO}7<*x`k{GxJJOZmsN4!`}w~
zq?8y|gYwWpHxM9SjntEsDY&TvQaO!?_ht!yQI~x@`~f?ubj8bZ$NKWET8zBIzAd@R
z6Q-jX$F_8^;-xbL`WsQ!QatTxAQ#}8OS=HK-Wa*PJDw6%p~`dP&azz*AwrpY;BEnl
zA=J?X2T-A$bGu%vZ>&eiOn^fu`@eko?su$aw81h%Aj#lHQt%eUSun@+?!B_bDBj<l
zsjRP9j6(Z?4ajaQve8`BB*who!v4L~U8HS8Myw14*urMFp#-80W0CKdu1%$Rd$Twm
z2%_9O1;u-t7Qn>X#)S~Gh6KC`mN8J76m4#c(W?1XbiO%EIh#1WnOJtdd|Jk!i6{Ey
zC}v*WlWv6J^Py<ui--gzfUes`Q3eo~X2cstP6qd>LEM^ruG@H}Q+@)3L%*oUeF>(U
zPZM@^<>dxkWaiuv;k1z>#i87^y#2=@*#W6es+FA&JuW+n@RALq?&6dtQEE!$xo8h(
ztfm~QEM;^VIE$rYM&+<4y>^<FMI|K17MT32&HoYdFZ}FETH|>ZG0K6*Qpg#1zoYjX
z;lrD<(+BTiK|1+eV_Xar8F+4>ikH<zvfK<6yvY7+j-@fOs)aZQHHIvK@BtE!o%Iuw
zvu>bWFofk9cdkG3*JZl^Im8~<GVhqD;r#9&da~wXIm7-=uDK5M&XK!^5|$<*pF7{X
zQ<(%c<a2l5ibEDB@#<oOIBJ~D1ZY1(_9vH@?4`U1Nq?MBpn2Q5fXjt`MA%omG@!Iq
zkuI#^v7*tjYnB;5XRrF_+G4k_Z2+SPl98Kxy%{~(K3Zn0{`hoAE_P`z^F583loaZC
zpq75{J>Y5UR<>>h0Ee<u%qOT*Nlq6vKhA*d(|BIB;pQ8>+tvTDp3m0TGOCtVd0)0H
zWi=ewK@Nu33K`HW4`;RpwB>^bpBJKG=f3Eb2YN-y1Q)t49slMuhJ8F|Ux3XYIUD<V
zo*<X;J%#8s{m9#U)(^nyozks^+(d674d%@<u|kZzoVDx{nFsn?;gfyuLAmdf^$?^S
z%CpRSi+GNETef@S{84EId~XQ~9jAs-O}YNpBRr}|d}=Kld8<T-g=Xu(iYB)eFTv|K
zd(Yvhx0LT3hEIjp%Kf`WtJ{`mp`J={mIUT2L9G@8$AW4@T@dEy2I^wI&Rec%H9$_g
zh4*mJfN?HsKX9tQgb_7Ua6e*eCIe8Fo428XbV+*2bi04J0eQBaonZmNaFbFQ*e4V7
zri<IcmCx={3vb23V)*QHiJKqEgZp)IJ51wJ6Vxbrf1ZH7<P9)=jC>kB8}T4JTqC(A
zK9~9}i(alZI4w~9k3;jM%Fuup^VieXa}A3flY1wQ-I6jddh_nI<i|rDFV^h&9Jech
zYpF^Xwq%XY4<LAu>g#88AFPS?wIoLn8(>(xgCK99!0c?HBQJPwDYMoB-0h@Jx5WT0
z0;mmW+KIi^Qw{3ZsvXYY^Vl9jCsa-ZJxJ(RXE+S>FA9F%y|;D*%y#-Q>^OaYgX2E3
zmppQLR8I1tgtgEZkfVA2!``w_ygxNmQ{lMZw3=bWdLJ)xZFWvT1-eXE^8bdwEx%xz
z-;JWKDYrwlSKlo?()RV(q@!O}7NY`$<vDIa=&bq&!7&W$Z|Av!3!R4u$hm~UoNp3a
zg~MbL?Q`ukZAZeCef%zk-V4G~N{}oV8oMhb3=3YKXh%In+h)zdKH|k@U<g&a6RzW+
zBL8?i$(4k+m$iTz8C(DJwl`E7Qvsl`rtTfXM{9g>0=;GyR5?(+9_aIL)hPERGF59c
zAOUc-xFTu<NpVtyK7#Dr!V&Hg&RAo?$;OIu$)g^-uGaFCVZsrI$k_t#xzz<bm*O`>
z!v=TrW$yU*;8YcV%YyY<FuyDiZ=h}hoB$GQh=oe`8#%Fa;!YDOGi2|7FglV)24-xI
z)i={H!%DqFG<R!jgNMvc6X{$Lr&N~Ojd%cyM4P1c4oqw|bu?#v$}SqKyL&Y8!athj
zlp)GZ#pCC%T~)~&^P99H?bmid&6<{~Ff+wEQfniw9%;=TobeQk`@snVBJYmglddz3
zK(;xK2D2v#%wV=DNn(-m-PKpsJ0|8LGq+%1b~D;MlIBUda5fLz<?%IENOx(Ed2zM0
zf}-ZyZy^1rxn+_hXFOpQ5Y6d)nD*jSaJrHi^eGCO^~Ukia6DZ)f6e`nYLm@z>3%;e
zAnx_EVDW6yqqyWx>r)G2!zU_J1j~#PJIEZN6uDC=YW_>FMvCI0{0R)3{Wh<L@mAWv
zKhw!s^O%LN5k5?h3)(lW^?7{O!W7`E*9tl3vwweFU8HCR*ZW$1y|-wkkU&YpMnd}K
zOCB$d3tk2-&ZZENezwXb+T}Wjh-;3^C)(5Xg<1*tO$_k>;df{vcC|=BehkuQ`!JL3
z8_PIU-RI5{*&WtBi4()n>4`}8DNdG^4daF+Xk#&7&BFsS8vW&klL<fFf~K^sN~mhk
zPa51G3i8G3Y7-0Be{GNM_kKEo@*d|uNdfOW>ndadZruRg8i3$?80xnWH~BsRcDC=O
z<+1~ydv<zJxbUUi$H6w*@M!iJ*u^CPzg$0I@dtq4{{_IGtdRDjl6POUJ{i0#1HUdU
zCmgTWHa0~ZmD2GbS5jU_1P`TIUjm}q#>{7OT3+v9^H>$wc=rN3M5MM#RX|bPdTReV
zu`J-TLRhX_-FGYkM$%TE93~r-Pk+X7h(<&#g)2u575*q)qr4Dt4N6}z+|5;Mc~4jK
ze7M6nL{IKDC8JFbpu0Fd^EYDl<OZqq3WPjj3_0@fDgv9#*F;!|G~S9&@wi0G3oZ7-
zh&54VL6pWJ`h8t9als=#t1olt&eb{=4mPx193At*H5ZQ}hGaJh5iQ!@;ELRZA&w@g
zCouJ)sKl+is;n8AySwN`B(0<&=}plffy<NJPmu?!_YOI_h5L;k>A^#79$GeX)ymc@
zCiwQujwPIQ{KD`zzTW>tNAV`yz2%)Lw~3@&4QDxlH2Zk+F`$gJOR(%!&e1a(EDezl
z9dh2blK4&0K9<=g{b7i_r#yhU!181th!QCUpDs*#7a#x8_&&Hj$<4rp^omHc9@x%&
zy}-JSziKwjNdH#2$1x;plHqy-tz88lZ4g*O%zockl<J++*7h#?TYSA`PV`22b&;w%
z=bWPu3+dpa$VQ&nP4##(8(9XO9-U6R8(Ubp!Utg0Mb#aAW8UDF4f*sMj?{N<!Nd8*
z4$c932t5C7_AcF!?;BG&LKm2|#X7D?zHm<1OJy9+FEdMx#9l84x_XI&c^fo!61v8v
zIyb;OFu~yN+W6b0b574YZDdwOZsN)W{UfIPxQWN(M-@4+t0Gdl7#?6{QM3OME0yB_
zR876yP8>{&v9X>oGbX*LI8_l6TWe_IM?k&5*0zTR<RDdBYIUjMSqV<%wZCxx_&TfT
zBaOca+=O*oXYS`Ok5e*%oKa8bkl@cqyKhpLzO{pR1u>FL<;&v}GyZ~~Qk)sv5R<=f
z{|051UMmDoh}0_+H5WGiP!7`^><;7D7@&R+?2XMnhb{Y<(+`4TzSh4LU^LJzk?yb`
zFW1#CjiR!nVpEpvD3BW_n#)Z;u8<aQ+3ui#v5I>PN4hiebHd~St#3Ru{qw<A)|@S+
z!QI9VPL{&EbmpH~L^N!aP9)LRwHm0jQL;cI(FP8j97};IsS>yFH157RVk8~4_^v@S
zkMvDbsV*vD=Zy=^0CX3!P9N-5_Ysw6G9EDSPNu-=cK5E&XkKo_?Whrfj3&ysFrg<y
zpgDQjXr5oh*$*#%>w!~OB+Q8}ooa{bsQ7V}OYiuOHo9ETV1y@SqzHtY=~<CkM#2VT
z2vo#85>G;koGh3Jfyhz`9UrJhOLI-i+KYHcR4Zc4G=}~%(pC3q?z^R9m%QI>0et<1
z0<T?9j>^U&za)X<bFB+qMOX8j@gLqtGo6$dfV^ECLFj_r)w}olKTrl#g%%U6NR6V3
zu$%Wr*!1^IZz<|4WGUcS!gf2C+X2D=uP>VX=O|k{W8lqv?m<+I>CVKx9{Z1_jO_85
z-JZ!cJzuu?cxj%$_VA$EwnQxn*t(?OurT}CsbA~vU&$ynj?JV#T;&{_7U$?*t+YH)
z+ZS&1clq^pQR<b|p+MLRT$<3SQ4kP$gQb0-y~3llUfTgD?9%7chJAR(<VtkVJdpq8
z(^y=Zj}Gz)+@sjDTP4&@#c$|dB_bO;xSL?Kqe49{u<4ns2?<3no$r2|(P$#gEvrju
z@Z?cE;FLPFBZN5<AD{MUlAMMIeB-10t>5L}+eL8^YT<*E1CYS<nyjdRWg{IT;N{3}
z6sQY-U0DWmU~%`!$GCstYJ7~pj<5rFxxt8^0a~6R6C*#ynp`WuMFHO#16W9HuU4@s
zZ}jaS3h-p}JZOjiskMQ8Q&xZkz%Ln${ilk)cH<5}=7v9wkN#cxU7obQM*=|m94ntL
z=9M~E=`sfAW_G~eZ^FM-v%o9S4e*}YjT~AK`#q~m0>V3>sAa^YLR{rh*BJp<yS>LH
z{C7eCB8MOF#z~ZI)+Qq)B&3lEW8&(=u3n~@u11FKGoL4V4%vc7ulPRQeR0jt;!AXY
zkj$Se-mqdl4H`+_40?IxJHyNNLP610TEa7GpfoqCd185`y%2QSUPvwwllZeRACoWJ
z3sbg*oLAZlK|rN%n0n_b!`uk(BVXEQYwpo2itM}M*GLuGIS8%_nLl4zo%XqkmtGm-
z888ISh*}}-l_BDQAy{W{s;>~=+kxfekW<aR(v5f}$DPq2bnO}j(TnGzmkj;?^9kOK
zJd+O$`?K1>`T%PIpH;H@^HV*$3#`R|^Mn4+!~OsM#Q%krdwX%46|=IuS<9RM8t{1`
Mq42y+?A5#f1tHCoj{pDw

literal 0
HcmV?d00001

diff --git a/docs/tutorial/celery+add.png b/docs/tutorial/celery+add.png
new file mode 100644
index 0000000000000000000000000000000000000000..eca8e02e2bda4995606deaf3516b681c6d963164
GIT binary patch
literal 72877
zcmeFZWmr^O9|uYagMgHjG)Q+yNOzYAf^>^?4=sXpi69^y0wPFChcp6$bazR2*IlFU
zIdblO?x%a7`{|x%)P45M-m~_9?Y-8o)`X}k%V6Ana2E~^4ns~>@(COq!XO+R;u8om
z*pq7~ehLQ%FKj6xp(-aKL80nsXKrb21_wv~*2K_oL5`We)5yrsu=58K!(B(WC&9tt
zPYiwAzx7aberuy>N>5AB)tw{6nnQfr440+WRB44CPH|q!+R02eYH;UCjyz>qq_@ph
zw|5z-y3pM@c{vtk<N@DTe3aGcc>#WY9LSxTtZWQ$CB(0+-%_P#z1n1;aD5z5kI<_8
zy7=VPZ~ziN;yA%8Yrm!N*83C}@X>|u0v@JDwgyh1Ay~spx95-{k;pUB%N5eY_xGON
ziIYlPBciz*`R%8i#%_<o$e<cKCp)LHA>5lsl1Hn=bL^(~7e#~d;7UGHAR-=62580b
zBeooCqoc>XhH%84p`%}BprcP_-o**SnZIXv+5RNi+#1Qq331WSW#Z;0t%Zni>=6;+
zwf@b`&B-zNixu&MZ<ycwH(t2-Q{9@XS*a*cP)#!}Iddf?I7YAyfrAgSghK*b@Ziq_
z@CVdACJ+t<{EGwrNTwtF^De?*I^sXuh@gw$;KbA=<mAA=>L!k6X0}c*?3~g1Q)0oX
zMl7FdIcq5?J~pwlVKp+fGd5#|+StPmffIy22Aei!&PEha8*5vq$50`v-=BC4wqd*3
zs3?Aa#Mw%SN=r$VLc-3`jDm-iot2$R_$~zng`lIU`Qs;&(*HXg{GSlj3ukBh$82nF
zZf>k@T&#AE7Hk~+{QPX}oNSz&EZ`F?PVTnOMo<=8C+a^Z`R6>6W=<xKmiEq;cD59-
z^BNi3xi||^QNh0G-~ax!(+q0)_nT~;{&!j60@+~iuyL@mv;BK+aHt?`?_*U<sF}64
zq@@ig5BLsYzDMkWzd!$fdFSsp-a1n2?~%NmT(^(B_0IqKNDU`5M+rL{@RiQOe|zSC
z2j714e+LS(!LIyPCH|E8_g+wE;k$xt|Mr>i-9x7FA~-lvI5|nNr%?FK6qE#9v(Z4z
zfv{JvDHzl9(v4-LO8ks>^77I!YUxAkjdt#oWY8nHGLIFf8($T>-Io%R%76X({#(ZF
zv<t5rVvC@Mwd2#wwd1S0&tks!=<Fo+2<{|u+2!Ls>@lUHK)C(V#?@ljAnE$=PO3Si
zhdC}3!LJ~HU!tg}vWoFo$)zE;_r7W^kA%m@y7i)`gb!K6d9BX#pS{ruBOL$z4w{D)
z9D3sRU9|sc4$k0XWJyt^zpwNF&=duT^7!9fu(yq$cl@Urkl5%~t<I=T3`w_|{0btg
zxIuWkaaevhIME5Llze8mx0;LvA7V+0c)Kc8s^SPZgEUCF*8kZ{!BJ>(yK$mO^0K1F
zH34(6O1GLU3M(G^-^zi8g5nj}bJV}+ry>?`Env|u&F*A1eOJ-h%qaHSYkf!L=5q1E
z{rd7O?p56f`o9HfqgJIgKA*H}{A!WrJ%Xh;KG7P2yLG-%RB7OI_OY{IJe#Gom{W0g
zA&hNecfO^&xb+4PZ->omr*=p9V!xZMyY7oF0iWBp?rfid@0H7!&ri<&UXQ9R(#u#W
zB}9~a<=SQD;~%WPSdt33GKWzyX%H1PUe~bb)ePO^n|qa9L0q(5yVGD5M!;6VQZbgP
zxbCr<;#Qa3n<5Y|=guhk_tNum{GNoZrTJcuzv2El<8|<Zks-&f;mn+gp1$+UVX)Xp
zVq><kv9NBx%S@BN_(O$)Vm#3kyodi>u<9E~?BgDjrOvmSwXQZBGxfC{t-VRSMR(^f
z44!QaeKK*`7-5O`;kBI_%YRm+&+76C=hjW;*MlU#oTy)6o#=f!A5?MBD^P23@F_R7
zv~t!*z^1AtPc3Wn4S{~~+F&kmrv0E2?^m13X&y7QGC5)vI1b-&v-t6~+%#KquU$Xy
zy*7g54su_uceF~@qk3*%uTEw~K1{{?UTpDto-N03mGudifleEIUjD*py2gcR$&8%G
zIzj0J_xIy56U?kMX1A@0;Yj`!Lh7D70%uF_uDI&vkKXiEIV|eJRlXeViWEM7VKtbe
zBpY+dZ0pNbw<|trRaAf1JtjmZaO0VQ_p&wdqnAs%m;#&ZpEW*fmPY<+Zow3>29>S;
zkt#I#>|}d-^5nb5Gri?mR2@qE%fiZ;Qhuiut%wJY3e39SyAG+zXxF-KWlD|5GN^C9
zl_4wHTkM#e^}X3jb!zq|G#vi?tVng@lz?x>WmK<XyJq8gU#iez(vjZZzGUR~dlIr1
zC2~F1hMO6K6@bAr_Dw?QN!vYYO>*B$2Z9(OkHg)cSgou@Rc7yaQVFnSFOQXYr<Z0H
zlv5sSAFTY)8=`uR9o0eRY0asFH5=S^bv)U(%XxFsc;n(1Bs=YWGA*<P?z5MIf*oP|
zSj$_Jl_xf!BxNs$^J%(G{ZKgFZ5qy2q<wvFuH2&B8ZP&{x5@{VxhC+Kldhi-`1>0k
zo=jL39qn6+_y?ZMc=qXgZauoVzS!~Bsk2$4S*Zax_3?lLo4Xq1FmIQX-SCz7{&zaz
zIU_?3m-VL>&>xRR$H2u~6zWtSd-d=+9t}UM9h(8Sgf-YY5&KSTS2ynuA!Ak25J`0Z
zw%^56RIZ_^-G)M>pFZ<<EK0}0rjJWlX{sI8)cGOw{?I*M&$YyJySjr`F+sKSB6O~~
zEKKGAG(#zrN%F*fHDxum?;CScIi*UziePEwl%oRYB|_05=)afcM3mvLT5PN4k$uy5
zA_cbXDStd(2)a02Gm!|o_cg_Jf}uKfoZEHEK}KLXR$cb}$ZjBYHm2aNsK8RRM9dmi
zErG7RpXcv$vQ?H}k#d>_|486yIX~XoSV-u4A)>!bm*zEa$Np(mP`h>MciQ%itSI6A
zgf*d)DK6`Md(r^z)P=3eS>ftb?$u<c$Ou9Xsx>L;a5mklpLbk#t6I*RP{_HF9(5q-
zuU3_iQAV7~r1QS`Ns%f!EA{V~nBI&_@6f|dHbd@n+EnAb7PI-V@_26-M~3uKGiudU
zpUq8PJPzBg99_zNrS%MyHYFW;lTEaF$R3~hh*5yPVE`Le<|~Vo3P}txSpkS1M0yso
zLEp8Deh^JTHl3%|QN5bFvAl5AUTTEP!o(a!CN$wXW)zeieQ#qAr>J~DemmvfM(9QL
zdj98$5W3VVUC6yuYjL67CnyR8(vG`LD4wzqH|7Oob<{OJJa2-3rhvR~B>Bxm+V}V^
zXb-|s7O{q)0@&Z@#rTc0ODb$81GB%Ykm-j%=dsK>Tj++&R$-@#c|#pJj1xJo*;me1
z(@vImD-4?u3{0=BjB7cJ-!39d^R~|TT<*#A`6omW&tn(Jw3>WeV<R&%uH&7uZ-G7%
z=A&S(c_^KS%w~Q@aUW5CzUhhJni}$?O=U`7iPA5W4603EBwqiJyh?#`#HhpilbMal
z@3<H&sFsHe{|uHC2yt(|?T3~nu*fJLU{PX5OJOvH$`FW=iX#Q@Nli)D5A+N6FIx{t
zAK<wWQ4$(QVuy|;aF|?jT}wk0rc6jx-mMEPzvE453JxMG890pRvkg}bDdiz+ClQ1e
zhq-jMGwGF?D@Dl|SQUPa8SYofLH61#=@7jBAch)_8Z-~zd1|;e{LJ8}4jmzw8na~d
zJHppn6MS5-Xh<tJnI2hh3-l*j9Ci{(D|h8N_E=kq^#Fcu9rQt6wNa{hGZA|$g?LE;
zItS5dHsd=H15_^K*qp`;@+Pa~{4X&D64|rhk=fp(-A)p?JI{*9u>zUTqg?3|JWxC_
zJ@`reI#HEeT$N8a(;9mrpax5zuO+0lgh~Igyn6S)^ITlWw|xgl+Y2G_5Y;zg{>bAJ
zm_p@KVJKS=7s%k3`H(hos8kMPsa(>h<foHZDVLsxdDH<i6mZ=GyCc#jg;{2}xe<gI
z#*fQC@>ypt7f+R2svF=n3SbS))6mii=uneioMeWvI*NhkXSwwzInW+Yu!qo%%+TX_
z+``jKaOPyE;i9+l4KLYsKp#!K?gA$3`%&_lfb*kUJ!vLKVa1{3wU?Xb^HRsI{%epZ
zMfn07*-Xo+j3o2r(Gi&2uRIS~rj9W;O67?6v(K08Di_<C?`s9!BfZ3BV=#iCLlU?I
zUIuSJHIp37)-l(_%_&x(F-@dIntYKJaaqQFB~`~MMD9;~tS|)8b3b3pjX$8087x-3
zSxhw_aiXK#-fJHebludt*>D~(?0Nl~-8{4*Z*O#etS6Bx>+`$r05^7~yBtF_5nIam
zId}ffx>{mL`E=$QRh&sRV0Q6NlS!z4H`sRPK$S=wCklX&&Be^5VwCGvq<LxRoxQG}
zi*WW1tn^kx+$`Ox@=p^=geV9pC>OLUsn$muqbH^i<yJvV-2HT2_M9M-R14#}vod_+
zT1&S^pQ}0>qnCm!L+yiPKZv{14Iq;Meq7|cjA(bPzQ|D)CxO~yv$6Psr~R^8VK>xb
z(jaGw+OD&4#$#igsi<z@z~x|$+#lhZFNo0Gd}2=Q=Tl6Rz=}l%iwA<OY-{6g(2tgM
z`evv7cIV=Whq&`(D>xQ4qB#gl%1CFQ&@|B>(4#c<JSNl4PC;*eLD!x(hP5v)i$&(q
z(0ywz;Kc5HZ2kcSGh`UUm{rdr@k0bVmS9wmNcgFAFl92-NN{N6^D{OW1hPXj1C!=b
zh%cE#D|UP1U1^h=%88duHx{igo=-^gA^OteDuq$3U}|EW5;jLaW6UzBdtK5){^_Uh
z%BXpRMfml85C@pn%m!zn#Ds8Io?c++I7=SS(7hH7;#<iiOJ5?VPwa~FrEE>GMC`lD
z2qJq4duSYm9Oe{RWclv;Lj37I_#tq)Vx9XDTmpcJF?=B!#{Ws;%1@>4>XQ0lM<<w{
zEzr@$#}rB_SpH&J(L1!NER+FvyUM(w%89o3id?atudVmd+R*#^iYyhC^zkjCr{zT0
zW7G{<6_iM4pv;S(|Dr>{#^fAqmRbzRvMkj@X1i(=&>Ql1rCGBp7lQg)is-LcPpSw9
z*ao-c=uWh>1eXh-GiDyO#qSw9J@Z4sX=!=8$9>NFci=mdOrL6V{xaVN{@PH#1!*Y|
zG~z|qtKQ^yO9=fty2J3lpD`|g{XC2`_x~C5fA4KZ+Gp+Y-{z2zOo+?0cRTtoitmaP
z)el`OZOMxH+s9z0qY#3B<DPAi#q#eE1KWsx3;2h$;KVKT4tB2r&XoKAfAs&a!2hEP
zh(?6#d{sk|G<<`rRR=ABp*r&)AI#7QSas*O)DXel$;jhZ<FfG_(3JxBgB8G@wnC@1
zzA7W_zY_iWI$&8$Watidrvd_G&0(=!d$B#D&~h+Gvq-<bZZr2W4FZ*_D-u4lmLZo#
zZ#j%bfWsf=b>AzL$MK5=Tvpw<UmiP;5DARZn;4eE`5J96qMuWOqbwo6F4Zhu;~qT!
zj!JJ{6SE`wNTd-JYr;?F`EOP~jx#sa#4ic9qjdnCu3r8;AeH_UDfq4C3z<(?jAf9g
z+6c)4hsjcL(^u<Iei$>C8OxXd%RwY58Ucl09ld^Pcl#0Sf<0^e&6*mwpTILIQRByr
z$GINV2+D>-d1@mc72@T^76FhhcIp%2&9#{ZM8c*u7@NOP;!W6Z@!+WvXqARj<L6O#
zWyAhVDW*e)>u37zZMOACBgSf}BEAiMK{^GkH)+2B@hSnFZ?XZ97-O>}VecBURz`dV
z8l2z5N#}df-d1khc9DY~u4BN(@m~(ErulAf_+Fo_if<fAAxWk$A%zND;Wc)HMzKD_
z-Z1Y=O>q=rf>9ftQq%8_liGXW2z*AT@lvyE87{y<#WIevrT7klaHNQCXpX=Lt(|`p
zYfNh6e(-~LYt+E^QGm;k;oJPEes1fi6$K6Q4RQWr)b2gUl^;n2dLPYx&(MC1(i9fP
z4@$g-HJ)jw345cnX%w%fdiIX`0w!b>Ck$}AyzCqxmgRs03`#sc^;-Xw`{aE9id&lZ
zafzPmc-v#=Uxq5eXW6+D6#8z{E)BMT_*Z}frW&r#t!CRr*kazh)Na>&_6CUJP1g!r
zFZi(Oq|e3HmCM@4_!`lz{;VJjBF<Ky(|MG>s4A)OH2Y@Mkx%M$ldh9Cg%*9O@09~M
zA+wgbDFs%eU#`#E2n_D$pDad+RM=FEw~wYc_42!39gSXaZskM;RQ}usq>SSuT*J-v
zg}3J~m6~%h&rOb1DPKcGfdS-Nz|rbw1vZQQQ=A9nST|dEyhHzVGbsW;?x0$L?&hwn
z8K<B*v^=x@jc~!DG0747Tj99*l2AL76v6pVFD&)UXumnk)VkSijFn{7A5T~Tw$(BI
zbyUB0YA@=A(9w{(&F8|3Qc(VBkE8WvO2W(3-EFD@a_AiV#g6Zd6$UX6cdPjjOcjU{
zKF_nMUVh&{JksdvOYQZV6Zsy=3&8YW$BRIB4JBTEshsf$+_f3V4w?4cspqko;I^Z4
z`wSQ_u_w4~(Be7>0=WEl2USF-r6Wl!VW@C5f>u&?@u=OldKtfVw;4@HF+lLrg>$QF
zv$Wg#*Ut<d>#^b&ng(t_u+Rp8DOpGD=tqjc=o{`Stih9Mx3qW}#dB~ITVV>HrVF4E
zYW=iJ{4JJ=4pXbL8h=2;A((l33{;~@@XY)o$Orgp^3ka7;`b`qMLoc@>!&6IEW&qm
zhumhp-Be})Z_XybXz~J$tu>s>42oxMRbL<#nR|t}8NoXvJB(C_>nATa*Ui?*ZJY&z
z1robtfUE`P@(3r82ziw65ijuu{E~S3E-IR7#2bKRR<E=Aa_e!xQ15qYTcnsJ+17j-
zF4W<znE;Bwat38NB6irR)L2=Abi@PA!slO2Q^QzmIwcw)g$aBPnT4Rcy4`CSE&+vg
z-K+1HCU#Fi(cgr1gKFJ@JX4|RSF6$EilI;H9WO@;)~J$&2Q<5c4}VHbTakGGiZ-ho
zhQ{uB5abFYBcMO|z-za?iq)%tzA2G+ck|Z{OnaeAg=WTo;{Eer<x8bYf2plKU;ljZ
z28*rV4~0xCuLcaAW8enf+`vMD7VJKxe6Le!yR}gb{c1Nm!?rTjUVpZdbk*EAZk{v_
zlXzw*Sq}jn^!KbEG4S;UYET3lmjs;I!t@7DGx^dU@ra)U*m>DVv`QbAnz_#17NG$p
z-`~+)(AkMx9lm4Z%0nN?Q=>Kjw<S;mtk;J=RWu<JXM15`?S1Gv^`=Zf-4RXZGHC~t
zBZl!)1gXFXO0BgdlzN?**S1dgxwr%bt*M(Nyu#5Uq#}o_g1SKG>&rMr0M@vODGR8l
zwy2D9&SUOe-H2oDF3p-m3F&S+>2FL{7GWM1RV{=<@&Cu3^AM06S#!XkX(j;FnN4u_
zoJ>|iBVIc=EZ}otp6|Zu3qZx4vU=mj7>v+*3Lfljf_i^U;juPEcUsyy9WP9R&N&y_
zK&P+6nob#4;AW|k{RMQty_gVDVeD@@p}R|OQ1Co&u1?~KxsgkLh{nyT4?)~SWfwKt
z!C;Glt{7%A>wS{aahHpNHW{&q-Nx9Egttpl64%&|vc}z>!}ij3RLcaz6KFb%Nt`}*
zBL#_Q9^!H%x=u<e0_Hu0<XS=DGGy-A!$k(OJ3btQc9Ru_X-osd1X08HmUsDmE}@gQ
zwOgABCXst)$czE+1@}9t`%RzY{~q_j#XqS{?y6c0(6ZlK;NdhPZQ6Z^o%S73Suk31
zlLkK`;+}p9GRA{b9wfd>7wk1kmddZyZDH8!epnq@5ggR76p{Ad!Wl=-{scGe_Ui;f
zeIJ?mO008|fobPKrS19UCUG+4C0y(V=$<h_z|<NM_lxMTfxHu*SlpXdYR?(>)iZxL
z$P=F=N^*S*A5SCcdy<@u>c~B<ZjFZn3g1;jUQ|!T8DlAG5zgOlb-*<*v7c{#!HG$o
zu>*ZSE}cg>Yl*A>lC1TiU;z7j!&dv2AOQ`<&oT`QBLrQLG{L74e5=V7KuW2JzuIZM
zxtH`m#tKtu!xC0B+4YmEz(lD-))C$jIwlcdFBd-ftqBXiB?!|E6B`o=8{xH7Zqr>$
za9CU-9GOMyqQFj_2^i}tI}jK5XqXvaX4e9dR_~Ofm?kwrKr%pLZwek0pUnHP|Js-|
zFdd_Phc}J`4N}rF^dp7bxCDERuulYwSIL?aQAd)w?-AB|n?wxy7wnOy=5!*pa8WvB
zB1%OF>T<{8S4&)f`|~!$-ry6UTMLZKRAIF!8f0nKd$^dWHc2FwH&z{~Nyj2ynMOOd
zV#}N!5c9!RUC{oq1oAwP@@d4G?>hF|G_zIBVYQItyjwu%kiuE4_(hv!y+9z@x=R^E
zvY>CpTBj>mZ5BRCKlR#7SbO1qi`zg+%H+sY=1OL_`XzJ%`T~`Wce3iMkl{Bt-_SIo
zI}2PmOPM>2>PTIoaAlh8DY|OXc_?H9d2<SJL96#6E_2(;Ly+okWyA*LO7Cp>_4Mn8
zf=7VpNRt?MepXK~tgNh%9kHT>kE5OL72sMv9T2W2gZ1m}k|jZyjzJw9GNi6KrR>zz
zo4^lGDZOen8gE*8m<<$Pv{!I&UL0T8Pjb^acx%bH3sGE#)FpP-+y_kCHj5FwuJ5O6
zB6QRU49wBy;OQmrWIUX56b4H6)w{_tL5emh6<UNd*;lg~YK_?E5h%Qjf{19%IZp~P
zC%L?Hy2A+gSOY&b@@+j-612<bVUIJYn_db_b$hZLR>WlMz30`lL`g}So4Er+YpP!%
zOFdjE80{2})$DO2RnzBSGG*aahuc^rm>wAUcu5s)g|N@K{Gqsu!0(ba-AUGG$KdFT
zF;?f9HCfx5xpwd`Rm|5!JI|&bW-m$}-qNcj)60<@@mJI)0vQ_r;{iQ&1}G2D8}pO5
z#s@ge(Ko)6p9d(0+yN;pK(*fv?hAP5LJ9M~R38H4iVB;-4^qH~AgD!n<GG7B`e2wD
zypssA--cjbJ<D<ZTu7xl4lwDn3Za~1O$LO^EDH73y_30p)n}jdih4suLs0F%%q2Hf
z`#S|I0<Ktz#Mo+0R=t%ePvF<3^y(9-MNh)~pm6&QYO&*qVj&=@op<2H1$JervlD4G
z|AUnO6;(x%_7h$;3+_W#^Q~?p-f9{Ojuf2+#@j`physjrb+1=r^fq92Q~=nx(o3V}
zR$)ZR0445SO!@rfwxPH59zbi`vwUZ4dM<?S_bg0LM`XyoO&f2nJu_V5j=F*A@y=yX
zA%<>4zKcSl=IZIp)~Z$p3+JC{v6MzN%Q{Tm6137xX%1$#@XkP6u1^;+bzFuu3V~-c
zQemS*{Mb2<6d=NiiI<<_^15I?N_#kwNy=lF=d3pjxyi;omh}VjOyeFKg%&6z_OEP!
zSl#`RDGV>Ti%iI43}6xy06vs;9@>1ovHDV-15j5FOl_?_T?iY@Ve1X_xjG;J)t`k%
zBXo5*SZLA_`DO&~Xt^1UtsLfpRht55r%vc%vy9<n5bv3;5g6eMVUAAsa@d#C&9c7D
zUV)wPFZ;`Z7{t$SuCL;C(rnvQM6Q-P&|SLzRJAJ-RB62AsT`H+3Q~I%xt)s8QLLWF
z+Q*9C#~W3_b=T(`TL2Ttj%cW=&UFLEr0~TAUd8ojeHg89Q9<?w%yVPk{1DYcEwAZw
z+;(P0O3f6AIgA6Q!6mzXr-`o$#=HZ}lSzlHOQ??QyO-WtZUFYPov7Ft>CltIM|4Ul
z0*kMq;zfUE@pqBIqxguuQgP|?>TcHBF<|x(X=+D2xJktyjFWTM`bBqvM3&}r{z(Xc
z9l5s(+QF90sjCHLy`|?z8y6M3@AFegA3GN}`J;HofZ@2W%`Ki)PaOY7v65||kS$i*
z;Ljz?OU=!Gmi`o~W)2=4T`W;{DlMJz7xOo!uAP)YRd8tH`vCfsgVBBTw1cZIJ^06X
znFaBJb5|@w!}XB5$|EEq1QNS#peEV`k-8Sc5cHinRJ!Eo`&RwJLj~G{A0An)=r4X!
z&#lR8rxpg5W$j)&as6ck&qOE8N7Df+^yYHB0Z-j8$kU1bG7A;9d)PfZ0au`}HrKLj
zGE}03juYbfEe9SN<me;g2y9nnk%F0Iq|(kHiQVY6QZiqEcdp?zE0NfTPmLm%yZ$$x
zO9LMj^a5a@w4e2yb1Sn*t^29Dp=_-i5YtSFVsVk#_V%A_<-#K(S6S2mdSW@Q#`jt%
zwxa~gW(PQVQ&vBOjmYgsU#rxeN(7?s`Tj7)a_!|`m8`WWYB<jal*-9<>+9(I(_ZNe
z1Q-bvMapOQTb`EJAPlTwMZk;rmXl=ra^p+wmlTI~qQFzC*tvB7dya1vb<VmC>$-zY
z0+^+Li375}mFl_efXO;pLZk4$3abI2eZkFil{De)HyHXVDzPgzNj4P@l)Wq9KK@bP
z>5q(2nxm9dv+4r;<YNH2YOCr23*H12(uL#lXw-mMJmxX>sa^fi`=Y3dk4~$-$0xJC
z7icQG$^1^b->45E4s&lT8kCZF0tvTA3X>=!vA48xu7MBRSHBK*#y(sMBhDmst();a
z(VI>Fq!_?-l`-A+_31?j`-6#hk$MhYKH#dYL3b1fk^79D$nCzS&PH7|oCUP6V+K$|
zQ-__pgUBFHUHhgxI0JHw&wopCF))FSUtsyZpChHH_13sW+7_9XB#Af!;a+d>#~-}2
zQ#mSW+Zm)_v?v2;$wyj|B`uhzu7=Q|56bGF%N46WWC5|Du!ienMgT?+xii}d0NG|3
z54i1(0_|nk4Zr|IhVweXoc$Y`7!k&*>?l4mLU{==S1W*ZSDm0dD%|R(cJ)yZnWmhy
z$ZKlu02J&jtm<$fHj$;})F-rplC<{42j}jo2uR5wbX{V~_2PKT26)xm%XD9^zae5C
zQW55{Lz*Z1gx~%dQDalVs4d^8N)s&F3z?gjLb5Gs!@piQz5+I>DGIrlea7Rgl5XbF
zFM5-eDA?h=U%A_vv7mt=YahK@AC`1ON`Wgl5hhI!W9!E=o;&W4CSbU1ksapQ(|J)7
zXI()HxwLt%Fa$G~0b4d_Wo>!f>da#n=+$<XJ@xc`=rka0DU6mGE+lB18^A-FB=22<
zHYp44N&d#Pz|-bMHh}?wFxyC)<8fdz*yN_T%9GK(xjRhoXFxB2WDA#BXawK@!DJ~E
zZbq8yn%bO*`aSPEY?a#O_c|W3h#B{xA=s)Lz{zzS$1<`;!)#}XrzkNVDbOav5#8Ja
z_wL$W4YX;`9_J<;>tkw2h?co=8Sj`OBDL2m!flv2QZeh}2{Ue|P2`h#IqG5JM}B_H
z2IL1J$V!|Xfx*&whnv`HINuBnpIJ7?gfi(Gzbj#0fwikgRqwfL;(maQprm{-rv5ch
zwP;T0%1Z1{=9b>69E%Z>aF|O}1Lye47THMRf0NVzZnQ<sA-cwE$Wl1mUNMB$eBc{I
z``gACpi?(wf+=cIO!`)2SPzlln!;bv#KMK;m^^qajua_$tmVsxjZO5Z?jzwme$Qr8
zOQ06;;kUqmyXUGZ!eyk2Pe~MzRU9eU!zTv0ONk6v(Z`@9idJ_%Y)sE`mRRDeUc}G<
z=7NUv_0-fY=yUBpIEt5TTXx(kYTagf=J{8W#J`*#yRJ<TF1I#NOa)%SJ2h*K`TWWV
znwWN*-Euf4VG_*aH)%&_i@EA~>I0OVFTn5b5*k`tAMp6oUzw;+6`&ulc{|kmE#t(2
zVt5C8&LY%;Aj-}Gqt6tpKXLy)uU;Mcguhl)sDSuGNVlQ)5Y{(AYXX2cTR8PM0Lg8(
z$fJ1AKVz`|(E1_k<#(L{pJ?8c<;)&umyag#tlnBG!pyzd4?7g;)zkifkv2MtKIc7c
zhL4Z}b_B>sRWWluM;rD)tlE_G-udq14h%5@0+;M2E}huu$oRPY#!u_$XYvzK(IUeZ
ztX+y4m>UBn3h}}PDs4$NH2mh`iRXVbdU|1a_nfdkc?O_TIV!$_T8iUA$JBo7ir{<W
z{J;!sHm2}0>o%l$^Duo}ka5XYE$cS=VMGMLuB$kHNcwk?{x|@BcjZ8GM|>Oq(QUmk
zof9iM;S0K_oXu^cATJuIpiKXto!0NcIFI8*x#hUI+MjOy(_#P>6%ft^_Ufhz*JE#A
zwL6w-f{eSWCh2W(=ngLLF`L_Gn7j+X?Vpz_8Mu&c|I+o_nJ92poI&?$oneOC<=LkI
z@hq}fjiB4#qz@$8-tOsq<=c=k76p`dKfU1b?V9h$fd0|n)^zz#bp-)(jz=*Y2IBF*
zZHkUZD!m3*m7T5}0^Fryz;%;2Oagy=c+`#0s;lLvlb;hJx(695)EWK2ZE5@?iMMj%
zs}%v;yC<+lh~A+|Z^SK17m)se0}r9d?ua0^h#=;z05jn8dXFO{X(UD=zdLC7Fdx&V
zH<^Fri=F`Lx_qO|Fg$kN1gOU6<LhTTOniPoTJb~!8i+=dPX0=W=rNMBmqni<Ke#4F
zGWa&dXLa70_#vV(a2ce~Y%{9pC?viL{&q9iWvC_s$o*`kKDT032;MjwZ{qDqZFQGx
zw24k1{L}I2qR24O8E{wiCh2{O{A;AWg2eK|>PGwJ{6BRI1a+I)ly|w6s*+5vgGKLn
z9fs*{*Nqox|G6R?2x$oefL%APE#<NV0v)A5bk5B)ow#L}QK?EJInw4}mjGDuvWvi1
zTn)z)Owk1Zc(!%bn108pUHM?O2~-(+&GQA?2Vl^x2LfxGQtE;8<(e1>S!@Ddx)c_%
zv8`F7)v2)7?%mM1L-jj#2DHFu4}$^PYUu@lhiWj6wh4^ncGS}0^h(&42a#ZWg2g~w
zFG8p6+wh)^0sPTOm6Tosi;Sdq;dUk_TwfmaZGjp6coek$r3#px_63@Y9=6|?KUnQ!
z(;S&^37Rao9NcWhRbhs;ulXV@kFCq+`plvh2((w^o1yYLAGRQ?fTBzi3LdTxcc0=S
zA#;@G%fZc`gL4ynK3MFCs)VWc_$<$#798$L!W3;-Mr?1m+k2I_JDn}A9%#p|8-<lQ
z6S2cJARxAC9s1}rc2&1?e6s}@Dnx95l+tgZ)X`iV-V>I&)$#XLEMe&|fEAT|W&!T4
z@3?d4jwRa@>m&g;TWQX0x#c&@YzZKzXC?sp$7VV1*)ga1W7g0BU!;qJJ`wd$)UK5s
zTht^&{s0vcw<!l#@QJ|9YdLqdw<;d%XP}CDiU&ekWB7V9<8|~F$D8AnpGFn<`^$}}
z2~JO?%0bGi0?eK@33sn(?6mH=A0?(C@%ac}9jc3LHw#<n9iAF_^Ue4GhrttYhpW@5
z97+|&y-tsCFZ3BQk6)CHOgJCE@4RXZWsU5|-+tn7LLW=IZ^jrjYc1&ANgzB<=2KR%
z=y`d9Gte%gek7ENtlxNbtV3BriQyvU+fhI#v~ebRn#(oNdSWE2(CBW)nGonrKHxx>
zHI?^fhmZcr7TW~Tjs&-F&N8559|hf<gd4XiCOOT9e+NVJVv$}J<Y_Jn0q&7!u)97|
zXca`}k+;=wu{}d#OTMTlalfc$J>L~XPM(91!`(-5Xsv)?Sc75Vz&<ig^W07MRVBLJ
zmU)uRiaW?!8O9s<R2Kq9$%+Ih7_$|S@uuxtFnG+m?yHmm-SwjI7f_MiJ6nM^{VSEV
z%Zy!=xH`oH$l|pfNp)l3{<Agk+Iw^2-{_TNZOhvT$VWqpSlf5HG;1JizVi&<`#D(g
z;L*!5koU0zQMF2d+k4rHb*+D45>TIJ%PV9cBBRR&e)yT2w^eu03&Y)$AhT%>5|xKx
z1l~hZ%<>E(@hx^s04TZoodYg<x)Zo)1xk9Le6l${_`Jf}5=`c$AfR&gIP!;%ZFL)P
zNO&8Q_74YDF3ul~XtmV0lVk<!`(zQ@l)uGZZ{_F|b%)tB>dO3WzRw8soZq5}aoT|s
zHq;xn1nO(%^EST&NP}rsa<cl}8#v`>z2QV$fIF~qZQtXtU-EJQlBmvMrHT<i|Bcfi
z33vV7?o|_8qa1R&7oAENKFfP6oYjcWUuwF1&Xx(XcF@~v-F6yuYb;XT+kH<i_2+}>
z+`CySotr$s?L|!HiLM#1>lk8Fvz7ydqp0x|x0$t7t}YpN0B>u7WHR;i0;@>a4XbK0
zXg*=?vc;X@Wxxo`sPPF3b?OCx-U`Im#P&%>b5+QJhtm>s5p#6~lCGZEn>u60<u?HT
z9>EWT9d@vA+K$SsRx9!97l5LFLL!Wc?~tQwCU@`?P!BPv|Aq)>;&TRfo<|CaLvYW<
zk{1ElE>zD|W-X{ru%DkZodLE2!52U&-ve_hI~pYzmy6CvdC04sEhpgd5Rif&aKBK^
zd#39p3%e06-lT>xArQd}dK|tu`Sli_BNV!_(9*`95)>Flka+~ceJ=fCwJ$FEWyozT
zk{tp^e@J<Ekh+y~n6yLF)(8lafk@hSLGnOWU;IhcshPZh!-6EiKrl7Zeju?eVd$>P
zx#DcDa?1KFwg8Z#O*6R9W73d>&z5k>lSx551Ru$vCY37x;$&whY1U(dg<t??=F|g)
z_j(f0@ETOo&}#`&s@Pf91&)`&Y|Z%)KV$Ywz?kk6*>VD_>BRa#XRfk!hfAHmoS=wx
z#<`am9se~Ux{cARUc1Oy!e%116QFw3e51}r5>u{sSWIp`AY978obsbm3_DUYnG2r-
zqskzR>QsO$@l2AFs6D+B+5LuiJbQCJN+?UQ>F?0M4~!qL*`a(5rUGRj0R9J`Y)J%g
zuLi+5APPtF><gVC!dQyzvqI|Zz2-EJ^-nO`#ZP@qJ<r`lt)$<ZbciR@Qf$<+38VoR
z_#bm&i-@j#q=ej*ufj~|lI>p?mi0bn{eaz9p7acBz?wP&h-*L>3;A{zdr+6VI-N4d
z7brlD!3%}URM@s^IDH|-!oVPyMkGyl;+R`90MhRX-+V?WF~J*P=Ls}SuuW}Ed_6#G
z$(DPki$!rCawkJc_vfdy8jvYvBgiMVE^cycro2xgiQEjY!qrUDhiQXGpirj*tz}3u
zTbD_;15{3$xaym6l67f_%l6c`rh)fSxFrKhhKdmMBXHQ}ekL!`&3F+S4t3nocz=U*
z%3@C<9o6VuFJ1M<B-RVUw4DQc7=1Pu-<pcbb|NDFFhm#JD|bYf#<1h0deFy-DD2}4
zHQ*vT8r1h8&!|&ej!vEJ1*6<r$0K9>J!147F1Oe(iqK48)~|n-fFSzo?^DaF3(1Hj
zUgEEDAtL)2KvfovAMEh2-mU8maG#@TSMRMh1m56L(<6Vxx@L6g(|TlTaw<GO`80KH
zFLJ8TJz46QYR|xqv<k{8)UQoY<U5o<z9lyCwF^tM4$vZFB_sYa*tLB}dx+;3)kKjD
zf;;nq$yR%L1f%x$-}o5wvcx~wH0kI~amFdbI*0MG-vg#hKV8{fG6#VgK+U%0Ft+Ai
zx5$xUVx}4eu+o_b4iOSqvF<_*urWS`hapcc;tx<yaMV55jeSiiT75@>6b!PqS}Dix
zqC-WlPh08*pp7r6$v!^~w5PSE2?&Ztro^7Wsjo7ZzW@f^L+$MRAeZ1kih;q8{T|rC
zxN~C*y>i9&qlg^sa2R2;ckWuEUQt-1n!w4Vwnq>L{b;-Hd3ulQ^{&9YGFAt#zr!}k
z9kc}@i1^4(Ne3CL$DY>7*5qgleF8kS?d1yJiM{aM5o+wf*KcO&yV(~maj#OS@43$<
z%!*L5P2m}1rEX^^bTNG4U~eL{Mv>?=33g}hi42gSN|tGsm`RrK?^hlPYI2e7{&v@&
z*vLGfbQ**bgjFp>Ux^wBym6w6CB8v_eGY6U2h2y4*rPZD4o_f-r)V}L&ESM~9skvU
z$&bOBw$rI@Gw!{yXp#WiUh=RIu-GO#dJ+_&x3?vuA!Xi=`VKVLUmIC=041xmqe_nk
zEyFU)1lVg(+syVY#r3&`P!xuD4)Dvaya)ki3%QoKd$|r-%IEEchndXk&shhge$XQH
z0W<o(MnuIkcm(L<7Sh<v8iizg=X`;>cUlgSG(J(mFOa_zQdQ;!EejfLvVc(q1CzN=
z-u_;bLa$v)6K~+jdogZx<NZ3MMuTlm5U6$yEH+7WLdnpN65N-~_`nc!fWapDsQrEd
zP;psfBWuO%<sX^c%b<Z+3a&sW(m;Az+<#U44&DLURx_b#zyY>0gt^t5`V00+-R=;%
zV<+WzG5C4nsjblGShM{uM&Q(|2IA9v1`fjhc2(5)19(S7cthE7(X62f6+pLmYL3A4
zu!lNWyG}58WS8Q8rK!7CB%zQk{~`w}Sqaug$79wBUD*&8+IyU~x~2=27Fm{66#EOt
zG6j^CTzk*wKY{YgM1DG=Pa|-M`Lqcpw!O)8-Q?Y72TDx+lHEBxs-y}h&to8f?1$YY
zu(ri;QV@tk;a8u4MHt$!Q+Zguyrd)c^McTX+rz1*7T#-MAdm!I1~&KLLFAAPf(5sm
z?WgWY>>36uiX$hWB2&s%A$M?-$p;W3R%M3I;x_V=v1bVz7fA$5akF&@?@i60D0*Vs
z)Dd=?1GGl(Z@W$5;DyVB=VLb{2EAi+zm)^mqKD%30U}kBAN(rLdW(P9-Xz2=XRh^|
zKRic4)u5zyfV^Zx5LvZn8(i7}a!G&dGj#&0<XV;8rMhPKh*^{Ji2l+67MT-D;}7rx
z#<5r!D={(@iw>A>6T1%%bdfm*1a*m!u?~Zr7*;8c=}Nj11Gu-EoRoa|kmra6kBodj
zS~=w(iK!~c=4NKO0Ez_5>$N&peS`=KGQ;v2XidLtWXTK{n#Jm<=?u-A=Mb8|r`Sim
zAcE#sr|-sk9r7?QA4m$m=A5E3BgNl82$3P)!PYlrt%Ja`HjnvUACNbWIZ+x55X9xZ
zafA+}jXe=Gg4$KR2%Kz$9$-;HC$OfW;k$-hvU6f|WaY;AcUYlXhsW+Y<voN0)lL>^
zDR4%9>5&fzl$ix7q)9Aw?PUh7_!}Wu=dTE`cOJqPPq-&@465NMkRWSYOFYEAQRG9+
z#4Td$yStlY>WU)RJtaqJO|Qjwyf}-U3fV`*6#PjZ*}@fGd=Ed;PLlRDrdospGwyb)
zU8)JcI=>)ckZ3O3<uT-0ut-nfw<Wi3!`Fw_GV}+kw0m>G;tQ`h$P8PP!YLnMZ(M3J
zq>WkCZS<JpJd$K;6zEl%8m3wbI80VJ^**Rwgg4c1%8ELTB=%muyzkrJa4MY5g5JxI
z>8Na4jM-8}nbRWr`hZ5?3>mvsvP=YfIzwqGVn<=5DKx>c*YYqfNPV6#88Q2NJJyiV
z&-Y5gAMt>&;MXOY{=Av^X<bLT(@!SW2FTCdUA6MNAKLDeWYZY~`x)Vz`eq_}6b?Zg
z#Y?&FH}`h<C-c(6?#~$8;^lI(zN)JddceCt%RsGLRl4>pryTmtkf7)t-7)rk=r%{!
z9A2wpo%gwZ2`W1ZSJ||w2}$MV!LO1gf6w_y)jH+?mdR$0<`P9B8f?|QMIn8HSq72T
zwf&UEgjtVr@5C;#r3251_hS5s;Z7Jur|2Sk6{^UByT*W{<U7tQ5NFxkTMHc&ZskD?
ztD@Y+uK#pQ>0~#!dO9bpFMTPnwe&@srw(cx;QcyYa8xtKL~zvR&-$lm3_m=^oHEN7
z6_$INi;tS$wcwtN6V8~{EkT1rG?ps($(YG{KXpp;p&Z<BMng*8<5kzc)agfh$Q^2)
zeLpVgRpee*{ml>%XZ$3c#TvvZNM7e2CssbvS>$1@w67LY=!7`L;_1l_%Gjz6TA;33
zpHzXReE$e3qTeA)g%&lYe6b2hjQH^GTZ|*us#aa8;H;$<`8a?Xcg2g&c;s{wWWBt-
zN-ZxGCRZ%zKTCs==YL*Z0YETFG<-@)6-|uL<NWSr!^+f9&J(G0FI0Q$+z&rKdFf<K
zz&@Ss3=UW5P^p%p$VED(j#l&)jUDXLsDdmdz;(Euc6=v!_HhArW(o`NL8m~?J7J=0
zsO(&52S{AQS%O0!S3lt}BEv_TMOsGM{1AT1aUAkH1n7wH;YZfeW-M^E-@y6)1d$W;
z8!qhY9tm26xRl>=3HHGFHL8-?PVEF6n9+Q}*$?c}@?~J!$v>}UNl_!RWu)iBw*`_V
zav+dgPUfz^{ik#=!G|9k7zK1c^QHgRK$7AH789Hm)`<GIE?}c81eAu~PxH~gUjsJI
zWPmPqbNtEU-&JQY2}c<;svEUDANwDv4G3hNB0v{At5g}LzO9QnQUP5|Ib9>-cAKt2
zn|d3)^U40Bi{XOiJ0cXmyxpe#DA5S(T5g+(a_chs`djA!`Z|r@%R8vu-Kn3{Z#S4K
z+63Y5K_`bH9;n_w^`eSygq6{4Hs9j!J_-bWTHpwqd}GwVT^nDRBfQg~(RaHYj*6fR
z9j`R%ZZ$#l8Yb_}dVfy6eHlv$po)?3pP{#_a0#=X8!t44Zr`At9N>aU5H<I1H|b1)
zVxtka&*1)gBIKze0&EQ-5tsQ`fp(eoeDfQ;vbQfa-q5I4+Ui+>B-|srnW>k6Fd9vM
z3jD3^nf+Gx3Otp!zThBX4FEH&3}81MuuQB_zurS5b9UWy99yf{(C<ew|KLhbq6q-?
z@6uTX${FQgB}fL#Q|}>R=Y9K~T`dF_g2o-&j~_INAiuQo|EKbT#XtAC^oUMAOz4_H
z{+C_-Nb}91b?@Pyi=&5SSIxTBKZb}V;!sFG&mc7mE$_l_cgRk-V643ub^yZw39NFI
zx_B(NyJ!~HMV>eLZnx{f50<^ANK`RCzuiTRur4~e*4X(^7s*l-wH*SFatp+!dMO*G
z?q2~>Xf?+$j`7yFsOBI!9%BXvj{(0m*Lw5uM!}*lS+t``U|doC@dvPot9iR>F%tdL
zb*1I^7#f%%Il=h3z!<jDlha#D?i<`3psioQ+KuUZg1g^B2bjM~+-}(&zvPg$K9QR#
zSPV@=If>`T%b~n^UyJTgn9e9^{J}D1r7tZlleoL+fv{JV+78f18ZX;9wbWHrVPqqP
z)Z<qM&ALJjEzIO)t@%Z@F_;@=1K86D2rN6xeZ76F8s32kg2Et37NfT@U0Z2WH6Q2-
zBB`{aC9f#1Kott)-qF4p39<pJ3(G(XkfoBPfI_6X4rDQn;(YfBde|B-OJSNq1(5Ry
zCfW_w_eXo0=>13KnXZWUO0CCB#m!2ECh!{;&#pl!uk1V~D{Npl#R1iLJ2~~w+~P=#
zSUFOV%B_sYJ6Alfc3Q=MiHlI<eQ|sY{G^FH1iEv}3nkJoZY}x%Jm(&)MwvCI>z|7z
zer8DMp^pNsTBr^f^tBeAU?u4ms0pv+UjFAVFTrZa0v8a~RDBD}T8FVUi~--<d=#Y7
zC^;_YgUD-MOk0=zh;eT?T|fiJUu*(Y3G?YEL38auVj&8aXgF>swmap)i2|9vFOAn8
zwSXlFN<P%k!D<7M($Dd*xKY+7S1(_SglekCIzv$sH;8bQ1M$r^6?QL_!NjDT-+II0
z&<zl(1Q5@^r<(u?=xD2Uvox#{Ud0QT$l*<>^Ng_2quuE3HPzoj>2`|*Do7?@W6`n_
ziV4`yiGr26@6fF3ilC8uovs@rKeih#Y+-)Ab!Rl?w$MGL)_0y@ac%YJhrYaLiQMn#
zR9u_FA#K6aurRfaKL$@REUy8CzYQuLJ;h23`MQr*XjCb#CSbW@DcUp;t-CIMezkfA
zOCQ46#PLrF%yEz^6eP8SW_%*I<1!NgiWAIvAH(3CntT1g&Z8KnxDfaP-Rj0vRBZf@
z@%KO9CsZQ6J@mz0%6tAOn8)l8ahg-*Q$#Ah0K;%{kr|#DsEGj34TNH;%5j^#!BSsO
z!uGgl`j#&1L#RnHX^q$CpJ7SU?>n<z2N7YzAdga2=?+9Ury@5s;}1X4nP>2udBG62
zH3<u?+MNB$it?IPlObK+z#fNo%0xUc14IAb@65F4z+O(}i~i>N?IgQ~YP-pop9_Hu
zBb=`dNA=Hd0UVgk>^?Q&GVft;mIW~dl$$Sq@~8h^is74J%T{`$`ykiy^^wiQP<<yn
zYV(I^)Ve{z0GS>xeQiLoIR;uE;^t#V#oaSweqNrZnh15nZtU5_-i(&Gw<kpwt7swh
zmF7d#E`~V+s`Mm?zUsfAz^d5$PC@Y)OEh+|`W`a1;5KkxA)jwAKBQ7@f)qrvW9IxI
z24P-3hc-O2V|x%Mqbs>Qp0opN3xo{%?n7I#PIhKzu{sG6-u=9{@Cg|Iy`~Mn5U6<8
zU8L{76Rx?(wtKiX==~nM;$vy%1kMkCI{qI0W)Hz%&`#hp5GiSHn&q^c%!wNO=VuG>
z-oa#_CW%Wx`>WtcK`L^v2~7Y<y|rsONtYR-=0%YCd%^1AE?_n&1G-T+EM8Ppw;x&*
z)qpK7rt8X1rY{))Q?OXm-A~^VzBDch@uh8D0xqk|o&ZQuN3)pd&_@v<Jjj^+s6b${
z-T+gva+lD&CxG4@vusv|Wn8$1CSBDDmg9SC+ua`D@%%-r-?&TWhM;kLGvdJ{LvKwW
z@Bm?mU6d^>m@bqqV%n)l7~m<{O)-*CF4)?^?Fh2W@;Fk0)S=jER&>U>*gMe1mLB5Z
zx$Ws%y44_BAuex2vAWVaV7KSkpiKe+z`~>gQ(O=jF1l%Nml7>fOWsn;cqDuW(Wxi&
zhyH?UVaIeesb&+(mwbD}W7JWC3z(0{fIN1s_n($BrHX!)Ox|wvt682RTY0%cDU#D3
zM*JhRcZ+0Jf5<JT(rT<Y14NcSt3EOBH{4#YipDT{*w42T&7rOXOdFLb?|V+77V^Yh
zOzZD<BU6PuC$MEmj8X*Lj+geTi^3QsCJ+3-0fBa|Y<fw?ZYT^-Nwi}ybOtfs0ANgV
zRB-b|!Nmk^KS8yupmycDGE$(Yo~A2%=>^gb?aah#EtA9q1J+R@ScE^`ePV(3_(#*K
z<dpYwa<MGN<xattLnks%x4i$3^gBQD4{oD(LtuKUxLR5n;Jy2b`gIK_QOP{WOAk8w
zN~$NGr&s)05dcG(q8gON;w^&tcTJDfk>urJLG{BiAM>iWA)=O$-B%|d;bR@fQbDi8
z(Z%$8zQv-Bu1sCi5;@X9Vx)o3aS88LRA&&#kbVY1Adw+a`8NUw@L`3Z#s^3&1N;in
zYKHbT=~Lf1^_&-<6^%%ENkm9wK2$bzZMwQV1(=)!mA)s7#OO04Ha#l*_0!<SxYaa~
z#BN<$gmJ7nN;|;;h~+gZEEWg@sTDAg`aW0wHs;C`N4meF_QtiM=0Bj||K_8BKm6>~
zeD)vy01Nz$?>~iQ_Wpfo1cRM;6XWaox8dP9Y=MqWD&y@{a_M&g^!*|(prZ#PlmEQ_
zLZ*LN571#K0glpmVe$F%zuyBk%s@1;#@aof`|r_MevFb}=iM!97mZt3B;6Y3g0iT@
z{gVNJod$%FhdL{Y03ht<3A;tIU>&TFlcyP7T(_C{9}gUclGE9v{;xO{0Ak;hLXX>L
z2hba5kRQ3=H!u2!aqY*0;#_a*9Q~G{|A*KpIzZ<*p=-7M<#_<nv%v_=bR~eke|e2)
zBn<2k7Kh$mpx9{u;~KSg!(6w^Kmto>{=W|V!ODd$^7D`5F4R5k*H4@=Se|jz?irTd
zSgScd|M+hg!Z!Ru#nYdQH9Phvy!Y<O>1FWwPF!eoY(o`w`^o_TLi0<0<9?qen|PGN
za~ZvCn)jMKUy*DR<gbPoih!P9|1_MT2)NA*-3h#QsYk#1TL6fUcl68wce`&xJy^<;
z81v#b$Pi7%>eNn<QS<t;V_va}Y)-0^ROq3<G6Y-A0sHlk5nvRUHpA>V5YB&pnYz{7
z{07Yi<lPv`<_m5vb{cH})@7))crKS1%X0g1>GVZll2lA9f2ZBIb%Wv-<kRNw1=3<V
zfOEtvTmqb{_4VcO<s;8yYaO#VNjTRYuq<wFa$}^Bcyhn7Xvykly5DetHrMiTaf~zM
z9E^=Y8rRj<<D5xc7LkuE2eN;9c>jk&+951c<)E%5l>PFhsI)QR*)6_daq}&PV$z#W
z+=0Pk*a95`XaM-N4^trNmI46t6SlMuAkME0>N!wsfEG&7SgXFh;bMBvs`nC@Z#h?c
z9pnx5U~Ne|lWl<K6iCz^gEF4ywA>Tu0aLGtfe$dUVc4rdx6#Mj{o~^9?U?j_f@rUC
z4q}-^CC|m)11>Ul(~-z{k88W`S0_ILy&pWmyW$5nSCkYjS>iLS&ZT6q)GY<N5W<>_
zdIJRxb=@}rVSC;<g7rn40EU)>*u-S#Tk3al^TXQ%AH!BB!34Pp!h2ua!U*Up%U-=|
zm=7c_u$im?Zf4~;F!5|!0x_H@mH9ehYieM>`LPddMcY`0+r5<c0LgJXQP`KDjP|HU
zIwb{bnCqtUa?P}CFwh+36kIG%GxO`OV5tz)=(qi{Io2PK-L_MIlFA12QZ=7j(j@Ua
z<tU{*1|E~mBVsOd#eoZ5@RKqEzta5$w?O^u(!BOV>;P&y@+P$d0pX+5HQ=XLv(Ezb
zZ4K549s~PK3j~tACLKCREj|}D)D(Uld43GMSh|CkVz&k*ibm8WUBw-rpz+SuY$BaX
zdB|F;mFvQ|;E0)3@XS+=!B~kNXLcmV-Fq;k9r)~lj?<4vLSGWcem!mX*vA>b#v6o|
zm4Jxp!?O9SRBp={Uzq}G5HPtt7)OcrwsDsXsEPeR45IXTJX(cvkK`BCIrv4A!~Ed1
zYv3q9(d>4H20+U}NcHFOuIM6YJ<KU*Dz~{j-P;bi2KIK$<m+g*Sk?cfdH;-B`!S-u
zCOH}SNJnI-tF}33*<9GPt^TSJznIiLD)!i^sEFA1!LR0oS8YgzUEj!cwz{@*?e)d-
z15=UB7W{zDQQz)Jh6D;Go>&5Iu8>hP5-fpzg^S6fzYctCcR?PfXSui=8G`>?hxca;
zT*CBAcF!4ose4L}g*`;wD2Hj=g1=T-Vs^Sae;t|w=wi?%QwIL0O_7_ks3U+L&kxrY
zGb^RS@B<0>35`f$@xW4D^R+w>-E@?`*VV=aTRb)i(kF{lAL?4oDs87HS`?J|=8<Ya
zie)QCfz@G8Iq^RfAYY8a!k13?P@&AqfahX+G*gVK&hByRrijk{l!}K8yUGW-Z2e>F
zFZiu3p4XmU_V;r$=PJm&Kq>Q?Lyf<!jXeFmvQPsh!{a}*uLf#%WK>>0_mJJK(Hsa$
zuffEDUmOc2{(t5Yu#pKSjx6qSu*~3ApKHScLkRC<{=ya5gcb{qj}3f(d-|57Km#*}
z_O~Zb{_|DAV5*KB_*r^u-gyNv6$4WonwI?Swo)Ld!G@@K79IS;vSyY(FdPA5{Z)MO
ztNpyVCs-O%hjE!@EVl_l0+nF&eNkQTam}EHGyZdSER(!WAK<7~hg>OffnqhBx2e1%
zV~zoI{tk>vZGkkvQ6KpEA&ZB?V8K-qFqa%HPd{%1ENobPl&G2P*u~)5!_jfy<42l^
zh}nCPm}vv~l#JNPQtgm*onk{V9_<)Q@bqAMf|2^_0+!fkYfL_6J7(Sju)H`!B8WAf
zY4Td?MB?9eVQxMl70A#Y=Y*Wy<}8VjB}GN*WZ*tCz*ehS@6I(<{NR~{g_7(*c<1|Z
zt57i*p33^OWauh`?gab<v4NJ+B@5c9lZCdhLNJ5r^Bx_%1e3t(M~r^ghiKu<t&{jX
zA9ebUFScv@%zKlGV$Lmccmf0VIQu{fWfG(+TFh@0hi4S8g5$OGid*9qCkMBJp1N~>
zr5s9RBnOw6_9fNXETD$V`#r5)j^o#Vu~qsyR^HpsUs#`)cf!UqtNzS4!yqVpkADg4
zvq57+i4RQ80sS)pe&ESED}u*yha<HO6_<7lP!bHvDG+e5n;0uG5n^dx4Zu~lR|{Xg
zKmXXGm&6LJfJ*_|jlN19+as$HZhfGSc!6K*$taR3zFrl%K~1`HnyGV#<>u{V0Ib>q
zxvN8-fk@EPle;mne96oTP;NZPx`fuU-+7&Z6@QgzY;`|@|LyXBu=n2aRQ~_}cu660
zNEz7_%8u-nL?R<HvO-yz2}gF0y^|H86dFQi_Ez>Ndv96C-uxa{ulMWq^7(y#|9*eB
z@Ar0l|JUv6oZ~vz^*qn(@wl%?F$ir+!`_L4Pc{QGi+p~+%|r~2q+{9e5MU`dL&;N-
zKj^44*O&LnC4CuN{SJ2CE|Bt5yqVouhB{$8*=OSm^lM#d%1IBuaWLFoDw^X0)T1?F
z5Lye>biHnU7pph>Qj!m<DjtHypk)lq*7=C8r$5ncL;I6ziZ9?>`i>)Bc;p|0_W2)v
zCux<_0bqdU@z3;#?&cBS{Cx0YwtyM6HRg`^z@rDY0?sQBZ8`yDD<xWdPy*XmOVoMv
zcJb3$L}<9VP;$POAx?$x-=C%mF0y+G4n9@W0Y9`J8zV71Lo|`+3X!2RJmS6;A|^dX
zEz*ZE`p-V(nRnI^1LO5BJaxg}3YYQund83cNFz63uka1>F?_`#8|-p1BKD$|e%TFT
zI#VFJQ;;07oy{d1|2k4;S&nIWS${*wdGZXJ0xcZ1^qFOkisN`a$cAUM3ZR%$*N<ec
zd_$<V@(9NPN<sYn;`@N7#CPNzz!R$<L^Dg~BvF+l-9G~!xb7|2pHW_?bs8`ncHhky
zU2gq}T0z`6E&gp0AdI_sZZ0Y70D{nTRdOVI@KhD@=qWjD{k$q`U<+8vg!}+!klE>i
zn!XH0+OK-!79X1@JZK%}5eZ-APek@pkK;s5@)PN|O&e3`HaK0uPp=`mHR2tqZ@q}i
z^MJ5!c?CYqFY`eAoVRqqU)G4fw#2I>-{VYQi7cN6%~1?jG*|Kb)&55@dY|RO=(tWH
zqVa0#kdYe$=etQ>_;cZ2(Ki+A!Pk;eM~pS+y{ARcsmqFEz2cy^TX-L%|0IkzfOH#w
z{Q+9V0J6a-Lea^W>5t35&LvwCc3?~uby}qPdVc5OE|h(ih<53kWltMYK)FoCnTm0P
zo@;4FaM;xtiPiE;8p&hfV6niw|BPtNYMlDaSt&B$J}qDTuv2*o*EQW3F@_^R>BfM4
z>%(kJdj&y+5;ZoL>~RUGD_J^gDA;oJiXF>dJtew@P7V_#zK)->2bUQZ>hUV5paxe%
zEBrWzEGz-xvR~RjlEV58<L`*0yF?v+Pk3M5;9RHZzFn1E_=x@W-@CfhFD7heAji1-
z_|2Q1f6N8aGJl+-gSC;xUH2b<^Q?A39GVoxj$#QDVW%I6g_VpMJp<Jkuh>K-R*6i*
zZmnI8S~_yc?nW{cz71H{F=43HGE|9uDc=$Im4NxPE{A+aiQ2n@`65nGtHAN3@Klwl
z?-bHEv0UY#2t~f^cE#~l2i1N2n+)^gvi-9s@*#3Z8;aR6`40Cq?vfe$U8a}Srdq^t
z1QESZt|weN@hK%#q@fFb%dONMJUt`l=~d3(LwU#D&$I9``g*`|#``n7+Nr;vXI>?j
z!gF{~M%v#_N<wg(pCA<HhcdVjD>y}m;7OuL$vMUQ(^7`!{i`!4Dg&@Jk%14G)iLH1
z_~s1i-i1SNWiC&StKKYhP(r`FOn97*BECjJO<<G-5gd}b1XH|5+u&ZbYpOBNp%Lt2
zd`db1>bv*#=g8;}x^!%ucL`?keYI-rgG^)GRg?!<Sd2af<fXcc^{mAomr8XX390WS
zvMK2xy72ateHAZdMOJV{SkUa#UB>&wiBDEKSWB90F{(UUS5r>Ep+pc(RC=L8<p`$u
zWKBk-Z+H?kE0Pa&7WwqV#o8K<c?;NnCT;QJC3)-dlki09K#-0dWzFhL@!xmc6aO7k
zIA7};<Q^C{Rb5X%QOD^j7A5A{RqEp8G7%xSCyKN7ojGicAI%$ZPgaQ8#5)hlp_@Ev
z^VzRk5pz~rPIWcqZ+yVq9F_c$<=qKpf1%B*%oVWbTEC<Z7BVWS#D9=KURy_k0WmH{
zd}k(w%Yw83RtS;+Av=R(S5l)*7J6M6Zt?9Fma{9W6sY!5=THgH?~XMB3(`ceyn4BY
zNCU+b{oen^J8=?M5XE{nw2I+Gd%zZPK6EMQ*fVxLwk)Z_i=!cne$kvdzMp+02r?dI
zk<uk!+&hu!&ePZGIQBWf%CuaKwa!i|L3B6VivY!c*86os$FCds#Ecg~kX(eyqI`GK
zB<o_G=wNc15YgSdn{)rxRSZhNYKv|y={hWDJi@*nb7mllpb+e0<|n;gspU6)mF{b$
zV@XK+>;e|2zVzdp1jVGE*Zrkgs&6EIoPWF0AuE>qM!8)e?ITJ8eUC2>FOysUsn$(S
zHJz(gDMTfsTK<<exg!Ku()v*m4;S@XejdEt@JMy1NK1UWuUH^)-$a$@t$E&&lI{aO
zbO~u6)sLJZ!nD%kbI@<aqe}16|9j?eJeda3$)9+5?|<mzlMp(|zWk%+zfU6uoJlD_
zN@y59o&Njhg0$^>2*;GPd$07bc#^+*dNw>L6eo{q1Ge+;YMNk05Q>4!-%<Y_1Bw-@
zPcFRgAHhKKPoc^niNF@q?)NhPJq8pjV#5%Y(l~$goVF3`f#l|=XaB=`K#XhgP^TW0
z++UmDt{r_j6F2}MnU;gwCG~&!3j6^nVQXUk|A(af-vR!3eLhqY^H5DUWm4fK;LtDW
zF=>i5%rR;H>O)AO(Iorv@A#T59D@IsyCLSW!kW|AWS~w|fRy9^%6s;nPyYFzE2wf3
zpF=CF0!mMF`>CdE$A!MAPs!1-UvThZi?o~x6cfdIsfRz_`_#}+kf-~f+u0CM5m;z_
z#iS^~@ykb2uNNc?5Hgti52llBhNH{(%`rMnUNMH%>enS4?Y~%0ZE3Y9e^!~-6$Q`7
zCeD%u7kTv_p#&ZN{#;~XfC(E^1_~;W#`Evu`N#pQ>`L+6AF8xLY6Q}BJ`gplQzNfQ
zZh%(h%hzIk+E!DX6xookTzW<7MO;9D1#JKxA5}C6JAEpm3xCfw9mxJA3)<bXpOY`&
z9Wy%kQyu`YumDH|hdk+{7p7Ghf_yML_5p2npJmcV8mKc<3VpQU)_s<wZx)Z^_?3KM
z`A=}d`IHRi{non2k_8^xCmyf9aiArk7TW+0F1jckjFvsXOQ=QLgO0Zc)cQ$JbX+G(
zoL7Up1G5efHp>NEw`_}nQJa4ksdS})WrRQy%G3pL46ciSd)5L>m3iPtC|2y}@i=ge
z7k6=tcvROPdHKedzE>ZVtPrfjD<N<e0m#ru%*;VO8T**yCAyE`)4e<=UJ8hk3pBO+
zOfMWv9+7xGVNn?{_l#|$t0WcddVf}caRKretnq)U*U>lf$h-giuBoCDu3PKme)xI3
zz^6SL9fuNM3rBFa0>7(c&js$eB{D8+{4AHbJB1_+B0+s$X&IN`Hkg-OrLsaTpl0v#
zzNaHvy6SO}L{RA67;T4YJ(#2|5o0i-VmtiB{__mqZz5Uky&EPk1^aO%C3-z7Z^bO4
z4XG#Xhib@ZB~8=jP>*tw0#|XxtwQ*StWq*mx#Ie&^UcbosYWB+;;b2D4yz?j&sMW;
zcUURpW!{iLPyuy49O3hw2(0I#p%30{$P${{V*&(f=E?hg062Om3|v(ozD|e*GW$No
z{>7<_dmx?Hirp*zj`LCqSL4|6l0wi6rujX^ZiCDCz2!;$I(YolJN7=JpfE#w^2(ej
zza!HRCSgnH6${-UOQ<ZwL;s=poa3N_CdHew(Zk^?8xsJ`@_|wK5h^r>Pa%lr{lJQ0
zVbHxi4fR<*f_I5HEm}g%?<&8JRbG@`BEDnWb-Z5iPc9jNaNPw7DqhH{CKiBxgCb~8
zc6>b|c6bheqiGru$N8Dr8*!tNWgWyjf=_2uQn-S>jyZn_>jq~*!d*)y>w+F5LTX6d
zoK~pkw-p7?a7aE$svU&WqUnYnpy<&6cT{dbf52Mc<AYFHiOy40yI^Z6ZAM%zkdIW~
zPn3g@y^+LVgYR7emRFx5asI*DB;ZY(d-Ia9YAjYvxc)`sjMvskmqS$z_-lM7)%OiO
zkSM0Iq#kz&YT{z8x{Tt&47GK^nr^`({9NBb>o?m6()n^WKKHay08y6Req`H2)(>kf
z@2<q2{s>v9YM<wK(_z1HhQ6?;yRTgTAS@#|QGB8hkwSP@y01|gEp(a=J>vBoj6Fpo
z0NZh?n^twIhZiQFzfVziu>|)dfwKJ8{TaT|O18Dv+yOcfWn81zv91KDTgM%Y4da%e
z+0=O=K1^0nOK7$P)k};neZxxA;i0Sx`X=Yg#v<sIn2UbIbmn<{!+;iv7l+`@d7agz
zZj9y^21X7-uJXN==SWcY2xP&s^*oHcb6P8@kb0u=os$3S=a_Wt(||U==Sb(iYNyL`
zDn4-$=+{+aK~g1^HppqryvX?6O-H)tyel{*P7<Kz%A;7LA;f8B(iN)alLXnCSx^B}
zT*PFh5ln^x8SkM<V3TwBh0b|`lzSDDYT0iQsS_fShr<@(W3V^upI$88)Hg`AaZPh|
zZ;kt{;Q!P{VN6M@5?c7v=_qnL1+)_3S#R&>7#<FMhZh2jp9vxLSmAIV5hR~nqZ;QU
z?bZpm#X&n0EKkny@tzrgbuBi`O;9=K+$*;Rfr_{e$EUe>l<BL58wiz4vTXo5Q>!@e
z6zxaCA6p4^cD7*IZEXVFxV1@bU07MJCV8qH!hO2>D-Pc4>tpwX?TAxbkxnx0j7>tL
zP<aG#bS|@+$9Fku6tuC=WlFxTGIN)VMdQ<6zJ>oxGFm86h~-C+&-f*Gnp6u^J&%K}
z_?ry)O%%t}9uQfT!X{35HgSEz21kRk-pnX`q&pty%lgJq%G$GIy_+YyPlftaFm#q}
z1V4j4G2IsTs-CEQd(VZ*Yl-O^8LwOlhtT6^n8|ISt9MjZgDi$fx<G)(wa0MA3i!Xd
z#R$pwfqvieeU!#m@KpcAuBi|wPGK0bfTnN!-JNLz#dW#MAbRT}BZnoDFodESdR;@%
zE#mO|A;Ft@Iw9*$J8E7#yRX0`pyO(ApmE6vWwJ9|SqX#40a2h0_m9Wb$p5MqKTE+L
zFXHeq?eSnyo{QK8LF@U+vDc%uRxJRQX-kLqfRV#&Z4+$gxk&c&1p!Mf{la_7=NZBa
zN2s&g(U-UD(=f@)<6*{P76WI-dTN6FHqW%Ol#7-mepbMzY!w7x>~Zhc_sb*?es0m)
zmDGo*921LxwDa{nH2=0$5&-av`^+Wmj8i2ch{om6@p1}CVGy9>nH@o;xn&9`ntfc>
z{ddLHU-c(q&}?MVJ)L9isZE8yz;y4i331;A&|Q6#i+?I+RtPAK%M+oqX$d4R4qo$Q
zV`f(En-FQs+*Np<N8J-Uv-=*<R!0CCw4`${>=JHJCMuN-BxLrm+I`Z_NiB%9r+4+f
zRFj-DDXQ<T1rn1FWpS&_Z_F`W5V6(LT^T2U?L%;M_}M70)bO<&1YTH2uq(~VKu27K
zU-T^w1a^y7xA1jzoF}77tsCB#JwPXtg`Tc9Zu&-3eS@|oZ8o%8ePL82f~4ME%nj^C
z?q$<kCXx|!-UM!s44%m0E=fA^kKA|#Ippoe6|>BSk_n%L=?Vq1lF%bhz@}2Sp}701
znE20*#3sml#zILEaS~j8`Mm#i!uP^trrS1PWTZ$+I0nF%VflVTwY08fVeJ;A++V07
zk7)M6_iD1LfCu2fN&BAHqd1YbkJ)zIL38fO1T#!KazA1%(RUBx9+(;*jZJ5Kr(Iur
ztWxnAE<phfFP-C<(T&&d?x64Q;WnS#Nlyt~2~x}z;|!8AC*WzD&<Z;kL{~Nbu9dBh
ztl~RCr0&i5T&o<i%6fsjAA4&8Vi+y1jkvYz$(WK+zR`Atz>uua;}$&9tRxkf7={it
zs)aO8|F`N!uPW`c6xVqxOpe88Akh{%w)zC8$T&vdtSMKK@thibBOVufs*<MT)b&@`
zuNS1T@Xa<VuNjitUQZs^WefGWDj$#KV#Pb=nnow{v`EN^2G#D-Df6x~ZR~!!Xdk`I
z<&6hbh8502T2=OR<ol8NSFwal<!yB}6fGZa()ux?78nNbvK!Yi<E++iGCm_bN{AOz
zbRqND9u+n`M&Kl2%Y~NN&-L=v+Y+5+(Xqs90K?vkuPE0ndot!(a4eI^m&6(Z&s_A+
z7R>C)1jP{XHWN^{@=>UWomNc2)MH`=OB(!7DftKJypz=zJ6+k64{(N0rjNuol`)?R
ze?}RVNJ+FYR%s+J@B$r$7@Pl??Hdq#e5&^zx2r6q#6w-66Di@Ll=h<(kHdd?%?nZy
zT`aj#YK*se#cY?aKP2g|>0a3lx=_v@YK0*fJDpwmAWKMA8-E1+ZWiAr0{YGBq+%UM
zou>rjZr>WcY3hljk#K9uy53CP5t7@(R-=A!{4}8PW~_5g1;C_?#;9(2%4l!un?h~S
z@D{{Fy`ZUhXLO;az%;a!cSg32NsM$3cD^)Jl`w^@cw4sR<?@b=nI_f*7&$}MB}^Kr
zuU|KE%=olqOYN-XYlp67FN!hI1do(mv$o{xwGza3AF*PDEtCyoTeZgYd1k!<ZKyDI
z)-QDR1TEByVn*$=%mMV%#JDZw8+c9+AJCi<`LN-TtHg=8AE3f=JH~rngG;?q!3WQ$
zjfiWgr0{jLzwm}-!cVl8zh6Y5RdCvcH}U?WPe-Y(-@k~3d=D`#T_V5rWo0ESrPcR`
zqZ$v@iAEMGs??TMmGP@+D!IwLbk9nCe^THldW|M!plY!<CoQPctdx<~$sJ3=w1IvQ
ztX#w8El+2A!=KRt+c0{Qvw`yB6FlE6l2bWoRsz!sG|7u%C5$$ylBXXxk=S-KLl$W?
zzIE{MGu7x162BQfKLiraw;)bbX*Rg{0a}Sv)BinZ!9YhVH^zkrUzVSg>ud|N|7Gi4
zG7+i62T=j$MbEUuV#vb8n}n1xUP=!lFWb0M<DB)ygxj$)VLrBZbx=A{2z{YU7~ySs
zh&9ftbT{#^r-*Q)bt8GPCnVP+N5edDbL1wzZkA%bVTrimi2v66kT=8a`N({PvM}eu
z^T$zS=<(XAP~!SqOajBL!;A*QWo~+Ad_g}hJpMd7yG{G@sexbFtQvInhXgM_nZ6>V
z)YrFWHAWi=k@BUP4+zO$4LUZ&VANAM^TbOZNWjR%8HV&_leATt`o<7<Q~_Ixv{;ci
zhaVx`toO0{ey@|Qinl%~ld^H+(8S;$s}dyP#%I7NBAFu)4e-MxoEXKn{H<om2tlz>
zQlw|lf@G*uyU%b@kN}ra`SwI@R;V&Ylt}~=rqTs`;5-h>>&EwU()`QeuMv=(s}S4J
zp;QutKE`YPiBE-?JcGL^;furyBM0I!%nVvWf9#|xSTg7HwiR1xnvtR={YE*|z{BPr
z?G-C)YhPwG@*>onGC{7NuHky@D9r;$)G1D^p+MBrR<)W&fA@L?rD7^YMxs&F=7=H6
zK~^$lJ7q4V@!jZv!XZiGKt%Q3$w##H47)FmU#P3_*XAFqJ3uIzJ+71W$EF8Kq-*r5
zp4KzA#F)7}kn^YCJ>y%WV~qbW)Gc@&Lt!{?Q?)=zL)uW8hdEBxLb~V}jxv_yS;ebA
zyI`z=+L56_7r8A^t^ZMS1oRsU^O@A&!XJ5#5&X=sEOq<(n2~w~*&>0mXLlU-`Sv^=
z0m?^G@3m0n`HM<V%R*So<r~R*#nzM1Bp(=fFGaNqRRl8x1o_&GU$*@{dU+AkT_59Y
zA)z%kp%;!-+Ul-3+0iJEo)F`7!19aNb*{W@493q5>%GY)I4Zxn5Kvh69Fw)VM1WGf
zKK6Wu4<{?)37Nj6ay|9_EqsE*mdMdu$h5e`s4~F%BJR?2<3ctC|KXQ8;}=VEFLzVi
zqw9}bW+eTnn(*#q(^Lfh4Qy^xjnt4Or<z+X^QbxZ*IOpvZ($<N-<ESZ%k;UeXv|f<
zo?lJh<O73&Hs!APFAnMVoYc|1^YrLCQ&;(4zKZo0spC9DbQ||v>1F2>^1^zFGZp9g
z^4?tB73pI^wu_f2uQ7em#*f#8Hx<Wu$7?h0(Osx%tW2k`F0P=-9AKKLJ#n>CVGtrx
zH@}h$`)=ac5Gv2W7>J6}Uxr<0^0Vo<Z-|7c{7jK{|Ggu*(SoBN`g^{b^&&2+^6bFt
zF%2;-JEy?MI&5Gu$(6d?$8?_Uu9@Baf!E|teq+Rpm}3N$WG`Gdg>AVao0}GgiZ_P_
z=EatloR$__Xxv)j;tl~8*DJ9ZkWiE~Rk%>{WWaqAqDq)KoRzR<BkQ9Y!m@53GF+8r
z(Mi{&H4A_F$DBa<v3RvGgj>6HUx^>*X}u5^KTxHNdOsPZmm6Z7Ev}JK#)PtYB<{TY
zW5G(9w6j4ZCrQ{Km(?IYcrDRhvq&K(-=XGlDTkU~uOD@1eo425eO{l~XG`U0EtfKh
z^Cv@i`$zAExaA3`H_G+C!o8@Xgd?spIbJ+hL-<68Yw2R0pqXt)Q?V9vO@LQp;G~7y
z=mx{1<u$S87g4OHD`$P5_q2Wr+vgk#Wvj|5c;Bnv>|d;~9P_K=n=(!mE*-Rf*<~M6
zpB!Q~;toj0BFMAJ?(bS<;$CDpPVm$NN6&3x{%Pw|@$a9UUww2Ay0Cn9g224*73)ln
zTYC5Ii{_N@mJY0290B(A(w_O*a8G!jmkDDVXU$X1%89uGi@^)?AM>@s{(RgmDV($6
z6&U4Yb)%xmX?xZ^(j2_M-g2A({%_D%D#oMrX~FEbGZDz={5g0wT*@2wT;~}a{^BEt
zoC(-c8$~xZbm0U4^U~z&IDxaLj=$17a;OB}IZ5l{!u6kzf|s^29It)qeXRM&Ar*ai
z=Spa)c+9_l)hyi8sOY+<$&o{B-0)84`k_Px<ZJx(QvO>~yn_r<IY$n?jDdHS7~8a7
z`uhub;$FCz9BWOI+<W9ugMt*V-cWYI^xq!^7vRiU6-7b(w)rE6CNCw&axL}r+anj~
zuj5{);LB6vnmHahv;yypahhNFcH|oU_p<%>vi-e8{=3@#`y>5lYxwWp_TNXs-_Itg
z|2|3o`y~CR?D^kafK+U;0)-(O93#t?T2JW69`(;(K0Ct(gG0cpR+tj_SWP%^R$%mM
z_CGsTxRetUkAx3D&AHA&bAcZ6zaMK*YZeg%+c4g_alX?56+>{OzA7U0y3N=;y=)jb
zyL^36<dO=j*AJF>4p)%;IHU^1{q@nwG`K4me%?-migbK`IkosjzJq*n2rgu%7GV*~
zB5%x(|9ob%Lh`L!oyK3{bVZ9ho&}p{e}PsA{{9XDOrR7Th16JL&{Lm*Q3`Ic;4YbK
zwY>e;SxU*{k3`7cLQxBFaAZ~B7`~8anf;o`o?1+lcV0f(4VUC6c*Ka2X@`HjeVYE?
z{!{thQS@vh7VFrDOrE=pXYSTMg>157mLrwyH{9U3McuOKBc*Ix4OF~$#0ni@=*T~X
zu|3p_qA{88j})o=yim)Mp}y!v9=QX$PzJY5KAyeA!UNn`*AOxm&1#1w6vzv1S8!cr
zY_AUejAY?9DDD5ckjbj7)7h<Na+~kr_i!v=RcT>*E4ST#_NRkp%zpIGtijk=NnYzY
z*DD|QfKMfUxejCz#iam)=I`BnQ`#2FLuH{uU0p?>*Dl3^^Rdn(_nJ+L6+QiGUb{d%
zcoobf;Usr^<8lb_Z7T<1e8<=@yp~o8Mr0JZUp&dEGZ#Y;Ch|KS8MArwHc&tAdltpd
zA|l*JD!lGRc1NaK9KYv?aJ+^fclz{#3DYXE%OM65G2Syqp!ael0Jg;Om)OGKHkc}X
z6}U@tOMB}ZHUY-;Md;kmR<7SS{91p?m4@^IwxMg!sM6|MG#1ESg-jNV@9f%E|LHfp
zzvwjjrFikQ>%LK!*0FcnPLP{~cW@;mQTWBm!!W+k0+67K4LoV&G<Rz5-e}5%)09Aj
zZQ1kl*;*M_$<NQahPwd=?e^&rwdpWiry;{thlHv@r27(u8)7YZQ6Qb202_Z(H@y|I
z?QH>$_XR7K@9@D!fvVP{e%0At5#WXENe83Mkx8mqpae4sGIvuhbuN!l*Oq<k+Z6wn
z--<IQJwY`^wwAj@a=C_#FVEMm4~awd19FcwHO}m9Ko$J~){h51DJ&{2J@oCuWqVbF
z9)p)Lj@`ycq)H)>rgieK7L*-LRdoXUB33l|4ZdY2Zs&sP(l=>;-t@y(wmy3!_2cPH
z`YYQbQ6`3Vz+d`Afv)s32mU5d!q1Qk+M?}#?#+|Xb9vsb^W#FhyTgZc`8`HKw&30L
zL846aLM@zK)@D>U_Zp}(ON@Cl%Rpl%k{{uy#MjL4WuQI259>f9=e6@>p2<oGv~xdk
zpIviUnoq#}eUS&gnA~w^h>FJOISpPD1H-0a$h9tix+b75nFAl=)+>ALbON=$TYne6
z(sx@>f%{UKCh)?XkOrk|ztjzZh$oUfSPrWOzZ;c7_x;Bi+4sE)U;sxZF$j@P1B0vI
z149$4;U?0B0x^gMZVUryI6{Ft*;n&i)1z53n?OG47pW{E>`RHA3vijwmg7KzgMzCj
zAp6jNEM{Tt_?!HivkEo+I~*JbD>3D`J4*E1XI;f2AY<*(np8C*qmO3~%tcEX5rTxW
zF@c662>MQWP&@u@=55fa8X}`mktrb6v5*K>D?<9@owBSmek0&>Y$|v`5ulHhSUdp1
zDid=_1K@v}LSz2SRiGcZfPMSI&!80eDgz<-1yn2YHJ_u93$6vym8yOjg1S#5ptL3R
zdc|&c`GEsR{8jed>QJEX7{kNpPgJM@%h_0urS4#op<)+{1&;VJ2kSm_E6~&Q{gtQ%
zkXF;!QLN`WNsRt@<X&<0vBz%za1~Ip7d+lQ$Y~ZJM5qx*CrXj0W;8Z^3X+s3WX54`
zA6e)AZ_V=4hnpUU6yy+%x3vvA?lU$e%d!cAKa88vye%98AjtI20s*y5rrRs#;7a87
zpf`Q84G$DyA281IMg?EaZ@Suuah{4}9e}OG5Hx#)9{Y0!#_0s(@Wbz~-Pm7EIwV5K
zecfCbYZHwy%^yU{xAOSJW^%pVuTDok3cFd-ivMt`lPQSftowGOLH@y4wzuMW5hsmc
zWUY=Q*>7nNf^wshWsTKW-J9y%nc#tbTnIlj99`2`L*IF>Vc1*mNK3UojU;+EI75k}
ztLU+oLVxpmfUOiik}Q9`@_EHA3L^{AsaWGGX+q9(KJ*mwTnG5$V7p-uI7NDsN_+fy
zupBXC3#X&ZwQ|cXh<cXEc5S$vCX=a`81sqkj%pnK^<c+rl3PPs(%M)CB)~{jQ5QYx
zqk2wl8U&KGW+#@Gb&b}%lX&H@9C<(Qw&(c!%QSsukcxc(8eFTr8&83yo>Wy~oFbr*
zqETb<czJygAA*y=u}<ANBvIzLtppZEHVOQQk!eF-EznTrkA`{d8E?VP{MJ)uewnI0
z<iRVr$kpY*6~`vJ{h(IppTT=;3G(pJeI@BvHO~8nqUEVRn{MFX31v#KLSNR_ZNtN*
zHjceUei`4q;jr1py|d3(cA9KEvhdD2<Anc$Y)Q^{<6ya9$_U4L&ARxc6jS2yK_w@$
z7X?uz^0y+r1o%)SO<-Jh=I}0xqu_AYDqI#8l_SaGV2C5+uswj?qs}$z&`feQP|HM`
zQER3mY_o}*{Df`o3|>`~=uJ@9rVE#Uw{O2mQOhg4wlUl3cc;B0`_|xm3Y`!``rH}8
zZy-gef;a;*A$`h2{>5KAp@pov{x^%HMM8Wt&zec#JWGwYQCv{PBbDl5q%3S>en)D8
z!M8PRy^ttXbNp>okBX5^P_WK4x~=16!X~<sbe8=~p;5^#iv4p}W>-4SMFseg9QR~B
z#~Z@)7L{uUYcTMwDQqLwAtCRZ(e29;ntet=oaCL%(rl3@r6Q2wPwiwu-6$Qm^<ODw
zb<_c)w6eCGg(J_~i>U?O4^f%d=tf{XRkp)$@^$YqeOyK+RLW=Y&oc$;)!|3@%SA|h
z{VvZW!eTu_Ut-Qq=Yk=1;N>>k-R87g@P9TX*F{o*eoH#jlVIOMWgu!S!K;Z){+j$C
znDl$8%Vy~MGKv@(q<wC~zY!ww+3HC7l5!IJyNFKO6c!)zICv0FE_7Mg*ll;Ap#CHw
zA>EXI;sPiT>{dB)n$A*$pufY{>zg@l5+Uz@s$My;J9X%GrbqkUb73ReR$;nF<oGpj
zO*v~TkXL#6@CBW~IEvSmOb9)CQ%{RCbuzl!Y3i8MZ7s@q(A%~X8Yt7I0t(2Y2+u$Q
z`vFS_R#GW8F?c*JcZpNz5E)j~#`Sk}Dv2%#U0V$&qtmcfwqLHV)_90d&sFu(XSso%
zNu2%p$_jJvpSysqIT0d9%}pa6MdAfI5)qPQe{tzszj;@T(9eQ`5ANmjW$x7o>JaNM
zkSPf<`Zh4cZtFh8CUf;+{KT|Z!dJhg$T<8KGz#0q7sF*VE`U(I)Q{ur=6BPj9OZu7
z$hELmF=2DB)^R-XcbKxzckgR_dq%;kV!WT6_w|BYenReRl{e=#v>5Zf{r3H@9sE#s
zf8khAHukHTFZ9z>#U^;HXBbjAn+Hv4UWn({aCROIA8f^8o~vwWjLcugvTlQIVINJm
z1xbh$PLu1euL{Ssu`ZHlc`6!*H>}=+N{J3<SdS_`O>#p9XMx4DU=bd4Y9%v_;aCYJ
z-r94^V?p)gqc6B>N?5|kw@E&tdGSzmG;`C^uS|8-N!#Bl3I3f0aJ432jP}O7YCRMz
z6gN)v_;r6;ag=y;{{7`EktBp5q3B-+b<(|HY7<q@7%FZi2j&X@n2bj?6HkKnK;!Fg
zH~PaxNs^RT8=Q^z-WF_RL}z-ZNTTr~V?^S)mc$w9@FPGMQuBngPM&0Zw%S;ph(~|+
zoRdN!{{F=^&nyz7EK)9iJtH^XvR+0iX}%D>zB+d2m7T~tCnQUL<~{;>MbJ=dL)Pgj
zV*BT1DyZxREz>5}9R;?tRp+_c^#}R!K16Pu)wp4HYGJR{<A7}U``#xL4qpp5ojVP!
zTdQ}3IAROOug{zs8h>^sbYRw#dMS<%bN;+``<~JA_nr>9zL%RJoHS|g80Y=@(JRgj
zU+Kn=->Y)d;^9Me>R$dWN{CzajpPu+06@3YDgxFn_4MTkkW@s<qK`dahN0tbbJc48
zCvYzoSOf^)(dXdWgNj0T&4_HrGbWH<zT|xyW`f||<q|mzljU;R%E$#es~U!anQw)w
zDwK9<==(X&KMY=`rYrXOm?hJV`8!jhm~&55)_O<R2#jkhM3WQF+CRHQ9E;bDb?tBu
z?*ENV9+t;;m>As%Fl5<?_A4eiKg%e+a{gDPgbcr!SwCdi(wyXSFt(h&eghJ?vI;BG
zleDx~unQ#qw}bse1N5dUzwvWf%FQ#bk&0+H&M8|wcH|iGyX8xrofV~zF6sJtT~XMs
z6Tk0edHeQDEAB^3i#$6m-Z9uuL_s6*eEy$U6}`6f=n@(UCx1kT#88D<1WGC|w5G~0
z_0}gaB$z>s9bjpwp4pC9MujP6;h8+%Ta)`$UqUn9AlKWLT_|U!;r^8%kuPAj6|y0z
zz04&RFHoxNyrr1bVneVnDl{T?J)Lm()B5Y|>ErrU73iM3(5}3SlnRR`-0HD@KQ*6L
z`a<dkZXud!<f|_$apsevk+C~pHZ{2XXlL0Qn?AAXur3At*@SspJ2lmn!120JVBm@k
zJBb^8hH-?CW~GJ-hr0DisUjP@c3%GELdp{UK!f|&*8=MKarvV^zDy|Z-`tnCQpn8p
zE_=VM+~4_FU-Z+$<A)Ne6gd0=hw923c|-2+#a<E!;u?yddc2Y~V;;s!r!}c{KI$HS
zIU62vUZ0+o>&IU|${M~>FSw|>Sp%QILWFE-#tD}1aqFnPE~XL~xBty`P{w;2J+q{9
zf8mLH1^=Cm`z=PU^TqpYfAxH9*PtEx;5XcIw2zanz$2l4W2%3oBfd)pT)?xfg_0xf
zGc&Y>A#Hqru{wX41gQ_u6)K4DIqDzj6iMOCWM|?uj~x05?|e_^F3NqR@x+G{VP0!u
z|M!rJ1-$bvs{Hj4zQhazL<s4#sUuB3+chtJtA%}Vy!F4TUHhj)1!lwSHqJo;T8;SA
zYxwSeUyhm6IKIwLPd=LayOsUxg@LoFG#a9p{{8E1=iwyvuJ?-k{YH5Gs~7OsFZ=yc
zlK-1GfrjcNoVcb+KJk&Om5NX^4TgDYN6tp?I<PwDUuN7mavd(i<%)lzwea$vvkRBf
zBvDax`tRxepM3S&AW5h1@P*6&$9jX(?*F#?Im6E@UacPK!x{6M+j4(=yLyjrJ>wHM
zo=ujz(1X{Pe&5#NY`+lHM6NXG9%UgvR#v8_coy7w_o|I@T2=Tm2#)+dE~>~UH%qeW
zYfBAHyLIb}HFewk#;$)?ePh}hP<4B?i82wrTWveK&pmm`W>CO+DWKXvK(@f$dMRF>
zb&=}X#*8YT=;f{W!uKJ-NdJu{d*b%pPOiQ;k-)bWAiXoBdCKPow+92w(_XjH-c1Pt
zh1PcNwYbktk9SG3J9E*#K}4;Ni4mCwNk3BXzYIt&yo|)iyKH_Q7+{+DvF^R>JkKdP
zKTf-l;QB&I+ca1&BI(E<Vll&^{X!`hy3>*)_GB$xgGW>Hz+&r3O@d)ZfQ!$lK?uHR
zW{HZ{lTfO+$@>;H>9)VfGJWcYC~3f}$dsl0n4mp2y%u?EtnIQlw@=zI-Puj6?D-PI
zsBP2G?YdmcZ|RSQ$!y#yYnR?obI_(HJRFN%jE|5+7f`%*+sUfGLg+_k{fx<#XFjO#
z@TZj~L4m}k5_)U>`m+6w;QB;qb>$p4ZR$>0!u2F~Dy5?3WhuS?aiOjdJS{YRHo}_Z
zS6N+t`Z1T#<E`epMxXOjuX%}f$Kq{!Z*cpe{5+^Mbj-T4)Pus^3vY_idvuN)&cqC3
zGNR)%^Ylt}q`AI0uQc1PWGMTzr_^B_-1+4O3f6S@t3Pr|@4V@j#AhAaliAu@&8$vU
zXr|rFDA-Cc3?x79+L&YGCpon9FbMzf`ghIE>jfIr!!)@=cMZn^SWbJCt;X3-j%WJC
zr6!7T40UK6!4jo#oN+~T71e$a2#S#}qDKeY(rP=47gkpN)be#MaR{51YaQO@MD32+
z9cTs>(uvJCVmDn93As@hy2kVlT0RAnlyAP@tSYAWAlIi8<7jG|F1AI<Y|ro-R|PGh
z&hRN-b4HuDwY8acELHK6$2s?5uLn_VcTEowFS+eGqet?x#ao<dGY152Drn(NmL7~^
z$x%*ASo0t}TGVEk&RFTSf4BDI1QVn)SRT|BMvk$%w4q=RSG78U#%5|qZSzX(Z@e2P
z?3$Bu(NU3ZE8BvjB`%4|^!2AdPzqb9-?At-P$0VYhQ2uCYnzt&^kTQ5uXD*tWmeb1
zf-|4;p}A4Mk7*nWHpa5(GV2{1w<8a@@Cq&D`jB;(=qlW*Q|*?ZDYFjnbKiK)_@-M%
zysCxMXh$wbi9+IVr(eT{k8|{TIen|B8v32D;C7HrSqN`CUcMOoNpys1oJm7N^D^Ia
zn)ni@^)JNR^Nq2KE#zS$gvbBK?a0HwSZ|Z@)M3eEbYJ;C9sfL)d+*9Rny|osdfRlK
zx=Y70bjHs8eJ$TUmYP1d=F%p9e@3BHZ1&Q*(dkdz<O2FeUwFoL@hF0>FliK-DwLIW
zYw^3s*L(Vy64qONlRh_o_;@=%JZ?vcuFJrvg-5eo!tmF&i8<%gWONpZ*d%p+&AnFs
z=5vOdzubQoaqmufzcHxET+y-e(yn^K`Gz)k0edFq3^n(@p01-n#?ldd{^BvO--~^Y
zJkRV#SVs-QO3n%xm<(lYS_IXc#nKr3T9Kk>q}?pp(vMBMi9IN+b!i?>kKQsbi!z=l
z81^`U*HG}weM^dFou=~+RkU?LsXjX8(Oapq!(Z1&8_C1gn_J6z$JP@CKIeR&UtY?w
zk<EXJ9n_p4H4Py#cyp71zH8+Ut?TA`p#V#?(~e%NufgYRtu6CLRP%$Rf|vG(jVJ2w
zEFNJQjuYgP%<!hx_DLHZDlBG*3NzC9Pue`e<ydZYJwMnMZL?z*w7lQ8_ry?NqKtlL
zE@If1R6f@9^i=Wt?cXKJ<unn!uMVUANagY#Fe=_Wg1LuFk$MqtDw?uaJ=T4Q4qnBz
zQ{Bm>oiunEwv@&7Rh82qM>8y(MRFOD{rtPhTEM!FoxOj)2te|GOQU9Ks9HFf%_Wb#
zvM2$npvDNDH~+p}DhH|-!NyyCsDFPdUR<onv5QY8H2za+A|Kku0Yz2w)fXE_tDr`x
zf{JOroxlBWQN>RPMO9AlyZwL9<m}87C<nRZtbP8+=^@XXAr9IC`Xfirn!WT)oRuYb
zb>ypny$fni+GnCii48XRD=E0mN6Ju@`|w9Ph)ZdY)|@Zl`>H;lI&z4O6W(d=Hxzob
zY`zVbitYO9kwY(|;hniRZ0e7!(F-8Hv3{AnedN$>g=9^07wh^<JjY45x^E<5#=krh
zED_!Mgq;;kVNH(i{~5~A=G38Y*ySFHNy(2BxBNEGPpkUw(O*S39w~OZMil>D?XBb-
zd>Z%O_|cljryMkvqeZ<)g^YsYs<Qi=u6gD4O(7T94ACV`(dxK#;o^RAGt%mre@7vG
zC_(0zQV`E<S*SkDGsj;VpKR**h7)&)T7+p}Ya+{b?U4;UQRIB7JxXu&JP7#Ee-~r^
z=lqi+@hSNR<sWcr;Lu(lnV7??Gg2CG{({Z9wtM-VD9&$Oty6?-bxF>i@11#%JJzxw
z*Tzf)&LEZguINuiTz%)w#-7*BF>(2EMUM>n<R9$Umaoc|ukDwZnev+aS<_y`P)sjM
z#gbq03T5G$SdGa3E)nUR?#SOykX_==IV#bEmlPUH5^ocaoDu(}<C$%Dgg-mp{&y88
zv*W`8d;ZnoAGOn;*VR7#Ups@q*)PeKv`3cG9r<Ln+BFF7PQrqv+Cjk<p)C+3ov>fv
z=}em~&~$zPXunyMNO0^kA8q1m<>1H}qD3M?dLSqNF$=wfE4l}Wp(;pe(?zN!9tr#s
z$c-9B`slRZfGrCGa3(wo6YtIdmO3aH9UPfXZBq!?c9pXGN~HCGbo^iZoZe03RDc+u
zL?ZECxj`7Mq7cv##p>rmDS4R?#_*dJ;=`)u_SkN;g?abBFnj&l-jrZD0W#*=x^KP?
zZ2n@d;Lq#5v+zv0ABL=adgVO20RaE0j>l(bxNwDtTVPCK7D&eZAh1#(%eJ`>;iV8i
zBNl)nK^o_Y2;OFlfS>si<l}`ebm8tE%xNm)CyD2}Q|@mQE-Y4ipUA|Ymh`Y4xrf|7
z6#<;r5LnFvF$lCI9+djS4=u;5U;qfW4`Q9WcBfCd4+y09VRn*9KQ_U_Sf|<0a=$Mr
ze{}n!T*8Y3nEgixG?vrWtg^=igrl>qqcX)nFaY<nwy!X74GG9ouNBJdl`wI7u>_G4
zbZJTNsKCUs1<?^XKgM@04|`R5%NvMtbG{}-FqiKJ<~8KHTPxwvDD?79i`#Qk)hjwm
z_Oq{MalWUz`tX*nYijF!^_H&lo?Y4md;|)?iDSVhas!4*l_?CYB#n;&&`$u9K(&zJ
z^;K}`=$7^dz{;6ner1>^iGA*ld7-G<Q_Gx8Hv0MplM<nyeo|;nP;CeP_O@xaOVZSE
zq@I3NvP#fjIQ~mpz^LusX#D1v(<$W#Jgx^nTl+cFmt5zbV_VX=PwD?DJ03B&eflKg
zI$&2{8+4Kak4skf;j$9rj*{@?%N`=>i-|xB&zzrnzLzGs|KV3>F>o3f1ZEBFgZZ*7
ziUPe4M}hyw2MW-=gy9e<i(ra{>)xk)fHxANfvg%sNQ@u`bN>@GP>jaguw<QtCc<x2
zy;M`u?pX+6Jy>+nby?pz-i!=<NsToM)Ieb&$A+|8vJeYtB*BI-ckwiY4Qg?$LV!lV
zC^NcLjh^DZ*_%QX_h$LQdgjcXRM)<5-<g7HB&zTj!@%tHbUDhyc58phgPuE`uZicz
zKp8|K_=#`yFmrsHc#$!S_C^bhVn8oi42%}W0LUCeh`Sku38R6!FhyiLdu8j*H~hUN
zkHa8)vF2^&P$4Eu7$RwiFa-7w00$4HH4zPJhY#hRm>fkLFIoY@XE^FZL5z8f#FX0E
zIsdw+=>uLOZo2v=*3fI@Nk5|RTYRtu*H3*IgrAuA(HIP)$3wOdUbap%GzosHVkPif
zF@8UOVs)dSeBTNUGq|b|2CVuD%y^CEX_q0Zwf_Nwb15O;AUhVtjqZ~xJ3%bOuo2`6
zw7>ber3u6qTMa9G=vlBO*aMd-M+?)$YOd;HMOuZY6P9~Y+-P*b_2mJMDOMvlLXIpc
z*E`@FTk`M&VvK#t@64l&+>YDkPQNrU{E4p823!E(qlXwyOy3T5h-LhFIfr@S69oz-
zzRN}SthLaQa=DV$u&KZR!<{I~rkGdNOsgI82!Sokp5f?C#ra;OV3T3Mq2NU(A>rcE
zXGiwvyDXe{Uk);mu?t{JfSjEae;FR;2a&7<q(MSb55HvBT~JMU0)9U5Me_W(7>S|Z
zpOI@nu>rn38PqEH6e&rH&{ZF`;hd}A260{Bw#Xd?7b>ya&RPJ)Lm94u&zazn&8j8W
zk;x8wz{+uvYUt5U!~*j!LKoRW*sz=pEk!G+0|YO=sa#lun3eKt^n^Yelm)HY2{f?d
zsVcTPiXG%qXGhAoxiknUZ?bxh?Dn?0lSgZt#MuHST2p(4@Sa%p+~*vn0a<RLQ2*`0
z2i|Ai-fC)$487LT%HOGIw`dLIo$8FLfUKpY29;>Sx=cN8oQMBCOSp?>gM9@y!xeV-
z%@JN%%(P9Tg%n+^Hpn5Pt!U5j72lM;p3-+_0n(}qfwxSlxWpB29Bdp3L$G7l@Et<0
zw{ZR->9?GACTL;4Trvm7?%=UKgzOrK(F^ZnC9j55u+|iYsgm04*iy3ahE|u!-jHuo
zuh;`kYWSE$*x&VPE^LRETzzbH<Ce#6@8i)q!B(sDKPTeQJNGOeIh6k?w$w>x?(&A*
zs*Us!v;fjEXow9)x#wmLmAcdiF;vBBJt)zH{eg%v8OYr2*w8f?Z)aR`OtlLkQ@D-h
zCvd{#{GWU)++VQq2%@-FQigWyJSj-7jzul4gWli*_6bC}Qp<lHk9%eD@k131jX#?T
z#_lYbx>{RC!WuZa9<ktW+t=)qpi_yC0tRq_&3*aHXs<qK518Y@a1z5|b+u&wrJrW_
zW-f1lM~OA&V-{Q6tC(X!tTH{X9)F=KE%LV@*KE>W{KA75=Yr&N4U~b6yuQ{*HBsg?
zH}`7fcD2|TF`=x`Pna=89ro#Ee%IsEDc?_9i`7NFQG8jw?YSWVgw}GQA!F0FcNS;K
zFB)!)Cr`KVmqnnB*kXk>oO%rXvPPa0){T2j^YSb{YuDW2GY#sd$`qYGjj_K<zWC|$
z*W0lUUE0+^#h+izLS^y>og%+9uR!O%@jicil$FL;2wT24$vywEvCzAA^^*4W*J2%(
z#`NYQ4KKnMg?obyn*?uEX>z|NIl2CjkdBV!^%Az|Bcs4hES`Ynexpf)wV<zvLft0d
z`8j8|7^B}1K8r2&Wa8-b$@^*{_FZcuo)`O&nS9l<!t;2$ca2Z5PA>XWHY7xGK6~#R
zHd4nIwa%6;-fG7B93yG%KqmdXfMN+5x;^eAG+F(r&PP;RmEK(R4L!OzvYmCOLBjf`
zpiux-qNtej4=ob2Nd_!DxavdCRz(nz);X3maD0iS_LsmgG3DN;s}b_;x#P>msy++R
z&;dpl4ExA$Fc_oTJI6vdITYDLNG^r4(j7BVm13*U1iBlo8yVe(KlUY(wC_a=DJJ!z
zLZZF&ef-^6aH@BHp{%MB+_?Bj%so;?)}Jgo+H`+sJ!q7hW8j<dwSLQ-S`}(sm(pn5
zYmCO1&!y)0tbGrov#=UUHw^RpLB2CO@Utjoq}jjSfP9|H#lCd5u4R%HX&%VPy|~VI
zuD^{ld1Y?YA-Ok-@*=#~<sb8fUrb)?r%YjOZl_ZJ6-Ux?e@Lj75HYE2Y|0q5@a+!q
zdqYyHi(W?CdEHQCW+1sJ@2Nse;mnmAwcHrx(8h{6fN)2>Z|u+BA!b>-{2azwTbS;x
z(1bP1#&2toV<5O&MP6vEW<GF-F*ndTAvD0kS?iX@1v(4qczolE#vrF+PTBAHvc2d$
z0w1Y?>DramsAsM>FY>mae~~U?3`bS#@aso}13$mF>0z)r+l>DB!Oxzco|Mq2g^<$e
zBRcwRbbFVju9E=9TLd1sD{S+^b<4L`t)z0laWd*?U%%rb(#ib#d`FF9!OdHp`4XkO
ze!V*!-}}v$h&?Ws(mocQ<wq`0v(gA&OecE&aw7Ku_KID$4$N*JH?83rViCKhs}fnC
z`t<`kep$v&b*jteDwh(vlr5$|ci>d!rP~2cHPs=SH0{CPFL6O!g!x!L4-<~6vPj=|
zZ#i__C#r3d6<vma><NKu!)8)0_|9*voC*d6(#mU0SyGgK%i^li+jTq3;uCu0&ViC8
zz+78w<O9pWI>_1rIaXGRGKBFzXH}iHJMQ0x7++H!T<Q`CFfw{aaCwYaUPQ@a@&~gw
zTUr9-T4wwzPKe>Mp{}Qprsw7zdpYiB?D_Rd$abT5&Vb(a3VT69W!~qn#$Sud=6d51
zFKgK+q`ILqNZV-$T`5FowVvikrRr{xs5RSZwT?w@WPfM5h_RP`HsmE>pUA*Lgc7t;
zBz$Q(;QVMfP=fXPAeHnhKO&d4#4G$)-kI;--S0kA%=PTaoI$>1@4~xIq^;!__4<7}
z%iAT4t%=V%<4N|Ik&Go@fz#pA;Q@D@DDzuhTvimPon2E7!ZHT2X8u6mP4bH^TnOo@
zW%r#<e>M7k3@0>Z7c8@Z^4|uFU|T#XErLz9Tb`gkvo)?Gu_fR=ah>Zo^ETFhnde+~
zQm$X20@or$b3Q9cPs5}7b|)ctB_GsWTMPIc_#J}J-tCvXIOPl9y#;;iG;=;#*ad^t
z+67yTY>@*!*;eKUe1<V>;Mts@ky`8+ODp^E)k^wSm``_~Q~7?0$qjn8$U<}S_!^3W
zUud52VhI{!jLZX!@`N}|;|(`4vs>actQ@zrY1-&;d8d8X9?%im(%m+pM^Q(HEfv;n
z1xnCWyl-{=b!qy<mI@0>hE-Y6oPD=JAXos)tj^)d8~W)X$1OHLytmqvO}$@_r7m0!
zzV!an=K1S`?E+8C8ohtA>yk-$Z1~yWnup01rSv~?Mw+QtUO=z)M@hPF&!ZPfQDk;r
z3KY*?d7DyIHry;Mm8GijBiCaKYM89LMOShsO14CB!D`M2HIU27ZJ>XsR*Ig$T6Wue
zO&yo%JJa}Z!Ukh_rM~;ir8eWar7~XQrpaNqDBaS$Ro7$ncQ&*>MimT+K{0EvrxBd*
z%d6hiN_&AkJ#Xq!-uQDr(zrS2(Q`DWG$$@AiRwtA1fCF)bGql4=PZ4S`XTJKzxIJI
zL)_kIYyXqa5U2i_yh%SJk%w8%mIK=A%tCq>E1ig<<HT*r0d0kTR|KJJYr-x1$)`tn
z@p(bVZwRV)z9Lyr5d4`kgCjD?Hj&|rqULrSp@(W&$wAs4e(1B^2v!aYf@t-y%;xLK
z;?KWm&{dJ+Co$9<53?N-drT;vD4AaWk(Q$73Wavw_$6^;m6ru(E_qjlS$`U7sau=c
z(DSVXMK8T5%ez!FUPesOk?U6Nym_Wtjwm$y=j%a=Mg*Z~8^nLg&O10b(nCjZYXlEx
z;2vXLY*qktQoDY%Wpf+2srviNN>(Y^?XLs7t1dBkSt|i<(Tw+fN<O)mghBT?9^OBA
zr#nOVq09(s*NydGUJQOP=K$=X@U+XpEjr;vm6{+VFkU^%TztdcvKq}2K6SnPLs>k<
z_%~sVzi<^!0A7?%5Ii-;A#9SkX*tN*>e?5gW8PU5SkXM(>g_YNWv&18UTGKepTAKH
zudcNmVD?&88quU~rs=nxIceitJ}iEb=t8RBvl3JT+N`2DDHz{$aNSU7ZBNj60ncV{
z5XwEjRIT@a7fBk!e0uEyk^p#c;=1oH307xoo_XPe%jCsekRZHgJtzF0@y}lyMCinL
zB206*)HR&e(%pMP%R8IZ;;qDIPWXkUNB?xYbL+vzEDHhqVY-cw<#=56+nhUH81Y;M
zWL2{u+ExOmdCMaPsR}g9gQhh!-LX$c(4tsdK)6^3vU4VnAPeJhK+B4uJbxX*ixdmt
z+mkK!^gcNPqb(~+@roznRs6mL(1934{fxrBWdHo^XS%A-ZU=D(w1%{A5_2yrZ>&QF
zL}&w%g^ry<OGv^T_LrtXNKUD!joC{Dmt9DC`6H?=5OgVC$#a_Tzt_7N$MRCReMW3#
zYeFc)BrkN_!ddk3@D@#yY+QFW2FlxvV#;ZimiJmt38+CIHPeC{yo0?MP6He&oN7N5
z3XHF6BYCe7rRgZ(8=s@!y>ZjjbGSE0Af(d<*`)LkN?4u+omhQ0AP|>|T|RI64}dx?
zdC+KcD&FSH<pTt6z(TBX*gczeKlm6y1RJ?oEb6ceGib>XAEA~Uv+mc)+`LLiMtW8V
z&_VyJ482)o4kvcb;83I`5~RU=NS5@yM)P+DQ6~!?DXC8_G_-~^o#@+!xEZ|AP795v
zG}Du_-+8~YOIpqSUj9M18FE$GE#0*_F-*8lA7oJt7snS?Vcx)5p%^2pIMjGX<(>Q4
zMn&>?UDgiDIL39s1Sx=Eq}fIFw}8SBQE`VveYtw4Pdm&hi_PYWw<cy4#M*R7`-DLn
zPmY3tC!?TDM&$}?s|s87>c15DrMeK6|FA#uPUFqVqPZ`P)`3fNA2R8D&uOS{Lf=OZ
zVV?;Q8fu{?7saP^<BEX#oQ*2I8Yzf$9JZiur<txt8VGDo(mn^G&>IEhK}nt|%~JU0
zzD0A}N~*tn`-bJv{iUD=v$+j*Wu4W$OX34x=kLB=FVSe!X{CH868M|@w_HQa=KY_k
z`7iIOpIXmbFU-7WGjve0YNr~%veMboVEo0O*F5{}N_qd>;i7D^rqko_g$OBad|T2&
z5Q<8JZZT!k0coW{8*0|`IJ1=LIb5}??)tWsC#ww(ce=6grTrkv(+4zgTpTd!)edo+
zR|5t?iOd<rLbv#*rRQA&oiM#4tX-a8>S{hnxjhOp_cMqHv<KF~_+vU_nGPAUJLjMb
zO#Rbuf{XsDA_$MX7SMU1Dwf0m$i~nFx5E&IRQOxHp~*)^-WmcxM1)8CRK>OShAaHL
z#+5xI_wHJqG6IDll2m9cJwBh{?x3-6A}w9ZodcQU84#)wYwFtFEC~rrZ|wt&;@lU&
z#vn>3GYg7EA2^Wfun842751Y&qw#Ui?w76pbD(Nt;V7DUJL-9Y*nj_a+(;OH0<6kv
z(DG6k%nA<hEHWSo!J|kgn3!Jajpv6btj`GaFhInJz=znGGl*!~co6bwUCzClw<M(K
zsOHciCVT}Thp^LLVa6_WkIXIcNRLPZP4~HWi@z13RnUf0n}A5PYXQ<~Ll&yy>(LCD
zI0b*B604hTmYgHIg0_hee^mt$xHPNwtjOZEvzZiXhF{zG8oQ4EkPxGo8MU(k6pz_c
z8VyK3u^$ZAVQx7&H4Lg-G7|A%!>{?#di*wO&I76<u<2Cma29kyW4wc=u^oWWRX^G%
zt^<IB+UZhJHz?O_UFC)#(jP*~LZL!max{L3ySS>iaE8jaP|#!sTyuJd#G<v8dmN&b
z;^3N8L;l%WM4QVtztVEOcV~5IIxj#N4Fi+vYAL2!ck&P|^Rh|Vlf){rCOfANc~+m2
zt9SLH>c!nE`ku{4_z9osJa@m^t_-TllZzz}W?h?h5m|9!BV`(hb2&LcS?m)ml$N&2
zZ$Ay!DrlOeMPXuhyVXM}B13iu7NMAJ+GQPy>H3mYwa2o<!J44StY>#;=jJ=kWu%)x
z8iKDZb7II)=A5sPmf0Jhx1JL<4YkN^3wj&5@2`s40>L=>&04-zF*4a;N>c8-x><$z
zLx2JrLIg&@+lZixM!Da~bu6=aAioG>0FrD38YY6_M1kve($iyp{!^GT1Qc7jD~yPb
z#~nM6v8t-JOs55VA4XyUW8yq*g<+SbVGL>8M>MX#KUAKm_Tg~0AX(abbVk(~wC%No
zeM|0}#XVt`TX<C-h-B6(#g&{A-Al@-TLE!Tlt>u0Wkj|+ITbYURz0wz8okCUMEBJQ
z)DaklY>kYCrYrfzih!E??f*mETSjHscI(1|C?H68htesCNQ;!xB3;tb4L8!=AkvM1
zgn)D-NZq7>Al)t9UHiQBdDr7w-~O}5`1aUi_zN%b%JZD_h<S9%8+0_jt9{L!`}PuR
zFh<@zT8_{36ku%0A*d*iti+-4QUg>|9F7RBG2(bI?7w6<S*IYf$iKSbqmUZcj#^Dg
zCzPDDaM?*pzoJb++08;iKXy?4^Obb?<La_4HRD911vdlI1G5>IRdQ*m>PibZxAlzi
zhM1Thix5`!nw*p*8D&h*LQ-v59thgPOwOck_+WAX_78IU3Z_Wc<I}v9Eat)zQ5Z0d
zET+(>_%+&V*~>lawEg0J1)%8@HR09p2K#}N?>+8}X1E>HXaYnur>OV_a;(50GY>o-
z;YQRs#Iu=?Uirs%xKGTC7(}|UEP(O4l?-jz6=bU{yn~#neI40Gd*4&@z_<SNo<S8p
zXLnleQ%O4t1HJy~R3K6I+)I(aHq7n_R#X>SZ38b)_v*$eAap32E{nb{Az|@oiS0)8
zJ?ddGm}ZiHTl0%L>FMtQdp{;adE0ms?e#la`M+}yiRt;4%!vk#ViltjE`w!H5Sj+7
zNR?}MpaXeNc0GZ39f9+Da`u|%T~|%e0SDefXy^<eAjkz(7;iuv7fJQvvyR2CJE+tk
zTV9^<40}kR<~e_D$<Qp=MY!-45Ag58j38M$G=K_z0)vHwCFrb+Qq6I8*hdZ&SAf@-
zrz9vtcNo2&$3R@;T!q*tI=)(m&BbM?DswMOw~bNPuIr&K=lh2DV61rP0<JYBT2>+F
zZzb>8+pO?~l(|^6Cpy}NtnOlMRN3=^y9NlY?TuL-`5*MEgu@sQKGcR}=mOxitp0h?
zQw4RW9}V9Ly0vdL46=A6HbLll$}G998wXF2u|Q_8BSGtthGuQKlw^r5I<*z*+QJvS
zxCmr|?Ou8@mr8pDMbglT3Sbop0LU|E$Qm*Qj4G|4!M7egh4zh?fgXTSEYsxkS+|Ha
zQ?OIypX%DU*<MnuAA}v-_kGKXh`v<-XGqQ6Yb$>*!f*o(3g^9BbMea5Wmz?6&;Eqw
zO@ibJ38to!KH?Oee04W7CzZwr-j>^eCwYT4r#AbNZ*c>>ZIffr4gjn|>5rNAp2mPu
zG)lAU68oiyhd{5^TkJz38glAAkd+px{MyX*ojB}$pwo~?n}ACwi%ZVIv63)hahuoZ
zp%A;EDJpT7hLLOe#o&dRrIaa5*1gw?`Ca;8&ge@v@v|`<ZjUhb8Syq0v<z~mG3tAU
za7;Fs3^rbv`^a2E)u-dR)c*2{COb-JmR%x@w~5w%`U+2+Rk13>7h{f=OnM5OQ}!oB
zJ8`KIU`W{RQ;+&JG<)P6Uz1XbVK~2?i=YxknK#-DTJ)`ze0sU8zAv-7#k`Of&tv&~
zu5{O!vmLQ+@D=~ApTSXzZ<!HZWpLn<+8E9kI3fl+ZvcG~zdq~+gm|nl@P&4Fjwo%p
zlMEedSXw+~D_cchXXE2}l^U#gu7yb}szBj>_@gsTfkj{@MgE|$?DAc|yo*t7kv-}X
zWo4>nE@T;djADb+ZXPsm+sa=7XcYKK%3Nq0H{vO%6M_gC_xA^|31!(df-KrpqNtrv
zjlT5+%<r`ZDZ(}V>0{9NJ|epi&L-3>Q&N~U=p1@a-ULz140*6k3FJx4?&=%B`tomE
z<1Mec`=YeG_vi<sg7v^x5V4j=YmRc%W)Z8b5}dYIt<ey)WDw<Dou5SgVOMT2z$_Gi
zuQgb$RTJ%Bf~2b&y6yJik$lHs;iyTVZcOvX)KLoyeOj7|^1|=Mh}xJ<htK5b6dRmN
zB3VzvkVPaYtB=GD<)k@ON;4=om+X`<T*;{EmCF`!ZcO|r0;^9N7U7DC3QB2lk<loZ
zkRSTquytE6uDmqMBQ5@g(*%Hl(>{ma`4W>FR<A-vNu);{tI{Tz{KXD^7b({zBA1U?
zG_oGuZR=s$>lTNQzGuDlnc`-O$-KxVD0+GyRtOG|BUplJ4%%w;#f{ohXK#8aPR6&!
zPmaP^5Bv|1(75_Y1)hJa(H}pst(w}rpph8oj_E;+ImQYQA48s(I#Sc@lPAj>NA}rZ
zoaGM323$V8e+uUp9wJIV7)r_(;7ApKdZ+nzfaHh3)DJdu57NUpFxfiW?C9jtsfi(z
zoPf8zcW(fFHaDYi>9CeUjZuHAv%u7IcRxb_!Zkw9DL4&%{}Y#TODQAj{TiZ!Hza$t
zD8>yzD8dUS`M#m_mUEHsZ!gHXU~!@@ye7D)&7jo*Nf>@(JOY|pL1hx-T7_8AQ!llF
z{m8(AhjT8d7u3H($!;kpHj4yY?uB8j#fHj>iSKdFr95lj>mAv3#VM=H&7A%qP{T4S
z>0zsH6N+Xd)(SpbdiEL5H|ZG4ar{vrbBba+yu0#@i={Y{B_(L9mt?W?6g(8q`TOR6
z3O{(2kC|gt%~SS?K0K+6HMlLk!0d5)t?Sy|ms~ym2-Tg6#b<F5>^;sKt)IbarhvKl
zl7(|iDpbAd;2W!sA%%@>X3`cBOGu4p{6hUrtbvzEAht6vj{GZ}Dz7=(fP~{W;;U3E
z5;$#~^Cvf-D^UZ2U@LO#XwLi`NJ4S&$}|t7$cu#9W!;&E{Kr*6u6>SVxV@$XTP#AQ
zn`a6A`Iju!;6WaSAyB};x@Yo>a{gs(oT^9VffA3fB~4qzfdwC-(aA-lJ<8!*b%dMU
zud1m^fuBH6yhY{JfxKhRr<bd_JS_Tf|MLs_*J3Jya7KiAZAO)@9;b%1BMqJN2Fn=9
zn_Y$6>y_bWlUNPnmKnt{(Z>gglRsh0>y??u!_n!S(hC(D=NgWNJ&YtxW{a<jtd5O(
zieux>Lsu|n{nMP|v)`tKtXuZ;{;*mI3+7*@F3ser%H7mhRQkE2amJ*+`pM*)CWq<b
zw$h4S<ziEiYt;<*T{20(RjN8QKLa<?yO>Kf6s6sDWvf)8?rOWOjgPc@FRz+1c@#ar
zb{HuV=TpFWU8i!lT#8+K%h$%_J(<p0SzU$tR=OJdA9Y*xH(K|n$efv13V+Iq=oZR$
zZ*&qsFv#Ig%YXPX<2lOfkTNsELNolTBfpS@@3@0Mqr}WA&&w|M2Ujg=<pr;@EXB_l
zeH)E0G|v*bD+@KwD)&_))D?eUZ`U!srcR}8cTSIMI;*g?r<11QRdyHdpanZgZsxm5
zF1fZ59M8~`3JuapC8wf2#&zc+w~{V!S2GuH<%nOrN)(?O^3Wl^-O_yePB5)WN|Y}-
zCogT&iK26P(ynZ>%qaUr-14)kl#(2{%805kTZ)6%7{%fjp(|EA>^tUrRI-{A(&vTv
zmF&p@C&LlJ5Urg8R4;I14WHjAhyy2rm65?Ph1k{toh%1{sN2i21*D_!wcEH3u15S=
zAiKd8fE$j=AN_$%{!vH3X?9zOqzx>OeSiO&e}4KvArv4b1k@*gp%qdYUf^f9!hQ=c
z{@))bQmlc>bb?97TVfZT{#%{$kDf^3w+x&ya9ZxKlXpNuXcge|$^4_C0k|2!wPGN7
zcTB5Q?qC0!&j<XBmO&%n-@73K$+o4RZaQiFr7@ue8WaBi%fC(}*;B3|CT6n&2~O(`
z0yg}hrV?;y4A7j{#nOi=tlrz=Z-6rp4RVbCnr-s@1?F9yn57f})6>i6-_mi}zbj1s
zK#jU3dJY`0_aJXM#K4OPyagkaoRQSDFo+*LK!;4_fLy+3Mh`BULkC>gZ(F^HJJJkj
z_&C5UaLCa+8sGdHhk+U)G8zY?PCHKI3C){chbJWH$u!<C5&fLzqDFv`T_4f!9hBSA
zjyeUwdl|Uk&hcY^5tq(TM4W>2RAecJtXMlClF<su4{T;x+&ma?hs0nzV`Gp0Lcsn-
zDF1n);8{870`P5{pQlRZuZNHfTnf$y2xY%P=YJGy)6nRoi->U6zZ7!6R*?9#Wx(vm
z(Rn~zqd=U04XD6xr*~9O19C|3=IW%lp11-^H^GFYGcds2FP>bFbWe@&g>)}=pnxgO
z@es{M_|SCP1MrRhKy8t8RBrv3N{%mHB=<UnclHAE4!2SC0<pwAz`QVke?|QiAXg-G
zfCR$W8VBGRIRrtKtfsk+u*4TDoCDCxJcqXVHl_eppTI%yZ-4|$*?go0dX>HSDh$EH
z0mzk1822NN?;e`zI41};-UZv?T@TdaIKa%A{Kn#9d#`?@jSBwX^5*3Of9PV~`<kOp
zeV9;V9UIeLPeBF~hZ+6K(z`Z|Lu2kMQ??a70pBpLfVbR{3^ZW*qkOv1d>B_B3gkB8
zT}`ovvOco%0;Ycb$XcYF48S0txEHPKw%EZ0`%cpG!Lq>va`V?StcE|CLFoqxpHriC
zS<Ckq$|g=CU$Gyp5<6ZkQr@71vemuC`{{YPNO_wkDcu=9nHJ_Sew@9v7VBP7JJ{Lb
z12T_WNrl`_ce}qY#zZHCMeknRN7?MIM-abaWoq4muBk5RTYhd@lB>?L+q((VTt^Li
zxZ9Bv(NX(`UT+?IYp4A7eFF&$b5(8UM#pEc)gi*$#X#yfFoneTohy9x1ZZDSe(QQb
z-ZHIt!w=A=i^BkAwP=FGW6JyVcw>~^X1~o9%Fvax-h?nH2&XE6XzD{CVK9e^wN`+A
z5eWD5Oj^u?F$I{AeYF*GPgVgH%+nNbD-<0dX^wY#VtZ#`JlW2pfQ%_H8K4C)e>lQJ
za=^>4TCC&UWQei>)iJ<0&22jb>1wP%aC8mBw~I#LLi7h(36||FjJ6X%{u&SiN>x@3
zpt}n~Eh0cz<Js=<>Ke@LB_mKbjH<zu=cTY^x!7<9Lw4;pnF&8sq+V|W<O6DsINi?!
zu}nCl&zt@usQC!+pn1ZkQ*kxm-Zf~9nNfwlwrT%cqds6{yfEZ=p7%jxLs60!bhIED
zz1Qc$D{mtTfl%ZVONy-&_i<$hg%49KsyNmQ;><gKMa@rs#PkooaCe^B9_VHPpX6H-
z#MG5UIUnczPjMt@Bao5+nj<h`nL>u`i!u!w2|Bn+F-WFEpl)cn$J~a?NZ)7pJOCXP
z3@x|d1#`Hw6rfqvtpFOPgn+{VAkDA=3_pBSnyvQ1JtMhpU{KYE0g)Rd!Ac7WUWga?
zSq?}vf55BpL0Y(?3m4zr?62~IN3VH7$Pwbl2ifZ2i*H3lW5EK0uA^)~Y;^mbmh|hx
zTn-TS)p4#w4eN~uQj%|tkltscSxDd)nBi`Vw^LyaFpKaj<5?i5!}mXwAhpE%%8tfb
zft5UIL7(dI>QJin?u@+fmBV445*8sXk@@d;l-3)3*@C@~N3|5W?Hd>PqVNYdX=Noz
zMBg1&x3*TNe;r`TWAw~?VY1$7#v%>wm?)xfjTV26J%Gi;S#0apatbsarOhlUizmoE
z>Uy9Dn&u!E@D3L5f)r`-9i%iP^eE8m+k@^t2U2@5pt~M#67L$)v!4Q&;=yU6O%xdN
z&Hl~~yR_><Mljj3N}a_7s9(^6?2c(Y$^&dx+P>e8L2+ym0?AgB40)(WRB<HD;fj6W
z`yC^RlqJ`+Jkl;CTZldMbEIk+52T{+HSBsAA6B~LXHXKE4sQ<)pYQ76A0nVFTn3K-
z1CrgK+kOlWyKO|<2NuocDm;@3RKHvH(Pt5m*|;c_ejDBk0LXa&zlB`@-C0^G#ap9U
z=HdpN6HZ~Z5`x&)z1ZU-kWw@cBtgMvryU3P)*@s#Bxa>D$dPu%KrEa8o*ZQ#9@1mD
zYhTBv^vt>wp0HfpgY4)1U79U?cm1PUDKK$QwCO_DDWbn~%AGgdZ<8YQcOX0X7Eq)<
zl4NgUkf&*SDuD>dx1qK}pd%nfo&PAoLf2Z}Ls|NhXlB+hNJlQF3#${1N3s42%LR)P
z@~wk~@NxOCF!xgMYCPO6B4TW#wd%bz;9rR22zkjV`v~do#|O|bX7ukOYK#7KZnUVb
zgY(4lXb3_kQ103u?Tncp8#+p>ltdo#j6FqW3Q(R5tvG#sh2aENRzI+y6jX-c-5aWF
zej+RGWe|MFsO(UP++dCCqI`#0SQP+rx}S$sQ62ESUp|wqO=Zj01SBNSd2;hdliB6L
zj-+B*iP4i?=dWvKDsK_N7CVUr3_amq?I=;5A*P~iSRec-Uy~qS0^R7_X_;P5L=O46
zDmo@uYimTsJWx<XFrutV&Fpuxv=I)`3AC%Xq5*t1w{6Vq7<=?9m~A4)&Z8R@SpDQ8
z))5xBcWrc$%*y_?!!?it%8eMx8BrAo0WX#2#_DGB;TCl)CZ6%ou8<4z-bx|Btz+x2
zrm~S>IT=Zg5^pg}Pm+-MLPb;*lq7TCWpjxpC9GAUm`;r3I^S?;rr&WP-I|_f|5R;Y
zNuLT7uiS**lv8TtQ|to$5P~1ZMc3e^*&(16wCV^netkvZM8=|cym|{q4+{}#b86!h
zDKmN9`R~%}2`%2ClkrKIFGLX+IM}6{*@Xxhf^-Tp8OQGc+g9`%!q~^85a9I~<-XW^
zKOnqtdTM2I9_S?u-eCB<H=MDt?hh$j(mV!dK=1<ZF8Pm&$i|jiJ5Ml8_LI=rc`4dK
z$kM|R$tlOQJsTR&icnsM3AjF@{NuZk)f)Qczq!-tR1ut?snppnoi>>itj@foc!L~T
zpKt2)M#bf=u6pdgTm9z}<ql+ggOSltTjyLqaSGJ8-8%S=(^XcTJT4cur>v@tPf3uX
zAHvuIPzXVlUy^l3ve%og0)|kE+a)IfhzWw<Zya6>qKybzaLP$E4w;#I&93)beeCA-
z-m;A$S0OAWfCHCe=>npV+8HLX^V>9v%et93iPKCcdMLM8&#%|ItIE{o_zPSZK44)I
z5Vd7N6c@B_*v>aE+<umht^zLD$n8D$vy{dkv|FpO?@qJGVZ&#9!eIkZK-tXG*aWzt
zh1S$I*q@b;9|6fxa`G28W#A0!>>#JzFW(~Z>JHlJr12-9=P*S*e2ZOgz*m3LhI*jv
z!YEg#;?9j)Y^N!o@w4@W$>cy019Q%(-J;6lnAQioZ#Znneuck)v0!k2y+|hdq*g<C
zFGa~@CUUZbyx&PsV9##o<nRsM7L{kw^-ATarMA4+omr5!GIoTonT15hfoLhHB7xr6
zxXiq3j47C#ARKnO8}|>NAHZ-iFdxM{t;U*v0g6@B6p`F_Ik=<(pN~+QVkq|F@!L#Y
zi&WS1dsPc&G%l1<gZc%izh5`JQ))CT9zG9VZRmU}{dH?4`5BWewf2j)esFbbC>3sj
zhk3;_!A%Zh#1w1ySErw#Q*!dcU&Tihk;jR2p*RF5un{ZO|M9s_r-<w%R{i=(Ktej5
z4`bCroDLDm74#Y_dS`0zS1tKq02Op<skeq{{_0G+fuU48!nP{@cbNxDVz7m$iU2Mj
zRe|*tBDuI1vecOb0WkJ3(0$|la8lxEivd-5IKOy7<s4yP`U2;d4I<PiT>ePKU>`$#
zI3R{31TwQuLn~x|KCGufK$Q`J=;(nr<3IPYp>Bc*2&*BT@R35i_34)FeMDIHQyx$V
zk{GAh!b$R{S)mf&9>t+6vdTejh*cSJnTkWdEvShZ-|;`Q08WSYFAp22DVK@tUDYWO
zMERkqSPa?Bp3PN_I5Lp^Hp3R2-hXwm&<Vd6d4Wo_qB!VXJ^9zAhJ#xFN#6j@U$^Nc
zaA0Wv9~`!r{tbl0!lh|-KpFH+S5U>8bn=z4&R0l1atiVX51iU9H^C@hSF{u7QF5p{
z!4$r<iGNc3WAClJ??x)~79&4<zaKX}Nh&h#!X9U1M{ao}!pa4RD8#ONH?vBPW;zL`
z_7H=w_bZGo6{|l!pAvVWK>wX6+2cupXSk=JbZiCrkl0S3z$gKWtsmG7%UaJ{#ZMqM
zU1J974NeP;q2O3Z65Rr6G=a?^*JecB1eo(A361k}ds}*0`5_ve!)ESV%L9<F;{kSC
zw0kG2+b~cteU4L2Y@`)7+3)~8Vk_wSCcZ43T`z%IR3Einc7R|2()CwsyG$mnL3(${
z%bwET(74~ttQ^|8pPy6$@2lzyCTVwE-<DWGxSxy_8M((PG+sOW>nWqPDC8xW2SsRD
z{b|yxz8BML8!wCN)<56!-D?(#R86d6%<18tICgBnC3<RScsjk~K?qi<BpYxE{=OJ|
z3{ya5y@!-wsWmdGDBGs8%@6jJ+f8@lE4#UmHlGW~bN>+Y-UlNfYIXsU+2&+?5JAjE
zcTsxeKI2riY*{=~HG+sX^SZ~i9beV&_b{lG;lW%#@hzE)A@fQH7sqJ!;%l>IFqMgR
z9#HPm%J9+5Ll>jS*wXI6%m(qva&hVuP%rQAhU#9@q<|^+dVn!O1L+BuY6jZsa@gsw
zt&GkqQb)}$%GN?=RD05^i-Vl2E*so7t$U6$--Q4iT=%e1V@AW^J!^E;vU=tI!C-k2
zgZz)<2D{InSl3l`C_l$WuYXSq91oBZ1hv}W_Q+^vSxA*h59`Yz4Oma|yFtUDi^dJq
z!}W8fB9LeMa2K?Qa7`P~VVFR+gI08|UMx@%6?{8}MiE_Znh2vwvy_UVxAKCTwG|>3
zzZLOYfb<0vs67xd)OPqG4&1hB-jsIgpk8YI7)U_^6^#koAY3mj{Y<<D)bx)Vu8t@5
zKIiA$gY?0tdy$@GLk-|4#m+@<s1<Dm)5<8Sb3GyL0VMUjEgZrLe!V#6JHC(h&7d+(
z*1rOwks60u(L3Oc3Ry0BBV}pCZ(966NONvC5WA!3@D*&prB@)f@qEgr_5Kg$zEzN-
z$W#@n>mvjA-vc^Ra~OaKo`YcS7Qmnq#_7CUtKcUCI{JC2m4x&xr{J#WyStESa#b{(
z0S1ToO^c`@5U!&GnT7OH<<bXfi5-qmv~I5hFj$BJ#4#Op8bhTn_=?=j6=NN_?m}u6
zNL|071|^0<{ZFmdt7lV1-xksA+txsFO+d&4qNfxRfc(A{5-L{#8DGMswdaK<4C+H3
zM9biSX0N;i&`>%0nR!M(;Os~c(P7&=DAz4n*!mXC1G<k)W+T#I^qmZn&o9CTJqX;y
zo7g%9^nN@ZlHqDU*L%{Ar-W2>VDKDjUM~GbR~VdmcT0>rj6uI5|2^3KJ85pi8Ahw&
zE~Kbgtl=_Q!wqdRh<Hl((A0js5+3NYck3E7(LsxRqgwX<03hI?80wWKfS7b~HNz<J
z7RdQC7E#sf`$a$~K?&rvN(k@}lh)XJoP#+c<dN(IGLZOL07#Y{24MnV)h0$@-+IYh
zgx3*!AoiG<&lt7+O)n~HBB)Upc^|1J4qb9$q#)-z1JJ^B$X4EUzwd>(Wmi=?50K@0
z2HD3q+RE&9yR9TFxj~QRsWCPAR9VM8=NKkpMeF0sh^)+s(jIbngF(~*=D`)Dw768j
zUNvY5QX4Q^j09-qUdK$5w3Ju$HdKtW*X3WJ^n+*4o0k1l5kLr2^T37@O#cFjg5F$=
zEEBIZP}LWWi(X!COpBvt&K9AghKQ|VK-3$s?c^VWyuJs#pvu6S4kWXaLPwrkh^mAv
zOg71Q)Q-?_p?%2Xu?q|!5~W~_*fmep2GG;UZ&<n`ac<FJS}t=D_5hlIWyD{SLh(By
z7>Gv^<dbv=VFR1|M?+8i)E-Tofj%cEaxeA~Rym4U8!cgM;T14f1*5COs77kWmTY@h
zo}Jo0%hd%VqJj{)Tq5&?r@NQ&OM{%vAa9D#6HPgz=}iNfa)WjlzU>Pm>X(VQL8Xvt
zru2#><oBd35+EvB;U&a!Xfvce#@<AEaqeTgClSQ4N@PNy+oj{S*ZxaU;ueG~a6Sk)
z6V*I3D4Y-RqB6|>EjFk@5#x9@3c(Nw?=i9aX@cw^^*-;hi`%PlKoLHf)k`P@sE!_F
zcCe&JE8AQMaj;~q9|1~F(WG|94s!j-5|S0Rh4(I9WX}}JIa((kVb<-RLfpN^__XKE
zl^)ax(>RTl=qY|H6EXDuM%lsbV;3#U6D<0^wp~9r4xhXn>IT$IQXN|$r`qbhwS)sQ
zlU~IYj^$!V9eiD}T$3y7vYMS)Wq9F*n`u4USQ-hW8+v5Y1b%+2^LSFL8v7i`WgRcE
zvm7iw9k^B+#M>#IcN<{SZ7$*)^cnRh+GgDV2Wr}HE2t6Ow-+4DX8US|07}pUjSD)I
z7lmg56F6<PmzCj0^vAt|8vgQrz{&r(2=nSAp?KLa5oAj7vN<{?42^&WiBoJmyLB=V
zeTTQ@KD7uLg$`32hklaNZXosHUXVWQi7BDyA@00<-kpo+jJYciIYq$U3(e!&M7w%n
z)aGM$nI%I+GgzB3z`js4|K3EL3|l}w>k8IkM!Y2<&>VC}lC_7F+0T_CzEJh4CR>_*
z!<-)ywsbhPmR_LADdZ11#G!dJ)Ne*_8>Y6>CpH455;2G*A`>~&V|_<qwg6tGaCa@B
zuhQHI<+r=GJ@MKnG9aLZJ#_{cWX&xq;hA4h_%WN8U0Jmi6CfYXBE00_h$vBQh<>#q
z7v&=(WgEnlW2FOPr=_QD{NW-kAis8tK}ub%j1qe+&c(}S>+_;->8ceLn%VlY9I=G!
z(B8L(H<ZHDeWkLVSc5DMSoOQb#^N0;_DOb6M{VLm7DLX$I+BrpF{Cg0xi|n!pkl2i
zS5SO4+iVqceMycwRIM+H)UrZR0C{j$pg=%Ht!9<;Wrqr1lPbSc`O)jR^y$@$?dPCS
zb%(da#dzJKSFq}`MT?wtB=SMGrXlPvw8ehW611gdSktK_F;auyt^0}E2V2VTnT=v|
zw5Fl@4*SfT1`92!y=@TBJo1CK^-g@ry%zKjd$pZ!aV=L66Wg3|7PP#|-I<xP-tx~}
zy{1d6XnVx&j@{8vF>a~#x`5c-yx>zQ)55FQ6gqqqC=Xu;hCWK?JY7U>j}DH<#AHe5
zga?a{L+&-A7HlvfEs`^TN&fA#Ps`s6ERrA<h$1f*Mk}TMK5&4Aq)DF#5gA0as<GB@
zmW>xKHUI+X-3tFgs5tFBr{B9>8PSmm4JX0Ha)4}!MKW%xD}V`%7<xeN7iKRs98R=|
zxtCa}agf0riMfKc*rtzU&8;VmGFA9Prw`jysKiF({i82rp+{;noIP5479(I!R>L?z
z1%i}v5|+5y+c7M~VHL$`qd%`TmN~8~(4<{>PgMB(vmMqd39>Q`p168^KW2<gu6o$-
zaJ~t&Dg(y_&8L>dmC|o~=)CflAINszS@5?${${VrNc8K0Z3ry079?We-1Iy_oO|)b
zSPN;_PY?EL_btsJG~TOvp0l||wy)^fAl8%A2D;7XhSc4=mo)o~krl8KY}TcA=58MS
zlfj{_r6TSICM`d(Z#VubdY*wp*X(OH^~#u%f)Pm|0E-44i3irL2766nJCXe?Wlv~_
zMv`){I;kR%7LmgrN8sl2AXYZ-{Hdn1Vhau1_@UP8AvK%@ZwAtVvTyS=Atl}q=P9O~
zZotShoL2MQ!Q9dS%<50I8{d3b%{iXUaTd>Y2uSO!Thwj3u9$tAGu}iQp6^4BYw@qa
zk62Bs?IB_XYP6zxdU3Z2F1dVn77X61K^hKA`QqP;A;(=%t~)O^m)~P~u-j+fz-cvw
zPj%n<-Ze<i%ry=>(0DDcN<qmT;&O+-k39@if`PcSDU8v5k<2?VVKM#yok9hPdgrO!
z&>jw#>Lu7xT{19Bd&g`gsZ-NY{Hb0C`QLNqE6IFRri}l+$RbH&xkQSp!bjn8pQm5h
z54JwNlzJCk*-iq^?kaD<>rHo8jQ6J?^ES?Xf0{8;y=v2&V=r1oHtWoSAUH(cGc@=>
zA@&x%>q2^M=e`XpAzcGUQ22w_HN1L3Z>$_?)W+dO26FquZOn-GA~CAtQ4K_X?c%!$
zpZ|!|PYik!7K(^zYm426+rBkv2ou551CvbCTL4*)FF)lMv%5=`>3_NbnQZO}BH^Cx
zNvXV(V~7+-tPbD%OoNV{e~6~o$7<I|g0(|Hh`evVk!FLhA2#IASIPX<Zf{wI3A5K$
zkJgwI)hi}|NLnCvlfIEF(%@yXPWe`Du>hG^WA|<px6t@uKDti1<H4?R8oq5;j(CQx
zv-g;j)l)74H)U!Hc6g*X7K>U;NvhNRx7gxqBLYUvSn#$Ht^kmng)QCRKpT+g79>LP
zR%UM`Kaz9r<Yq2v@Y7aXJx$PCN{P3(C^RX)EJxhM?A}k@_W&0M=T;Y*I+GenJ4@T&
zf9aVJ7^7tR=b<0>n%Cek%Xub75?wuH3E_1*wNJtJO*Iiea#-GLCgO;M6pXx{Wm`)`
z3n|T_e1dO#7QE}pvn6+NBKvQb_*vWPbe3lt#69)l@^)zv<-3p-3(_HYxOU3SM60Rm
zWK}A-LsXPYmbUmN>Lt;=4wBV3+xs?+61{eEvd-uG5wQXi`KgS8TX{~KDmn7$Yq%fj
z+Z=}|uFIVDnJ#+CnE@^Q%(&<PV)FHtJ$GbRhfTXcV~pl)ktg|>3g)%vG|!pefwi3S
zX6OZeF*~8(%f$f`O2pdEJkpOzY_}N6X=0Hr_q%0H%ZkMv6+LvWK=)(xN?64~v*Ls1
z@~VZp3kXc2n9JNh*w3~+8c}Y080)(l>_I0Xt~HkSL@qxiQ?)xc@+gefK<6putJ*_f
z9;z=);af53E3_BmD%`mRTLmoq7m0!F!E5wZ^_^hFE85E+-r=?q-+D0_y8iL2ixHls
z{PNyJ+@dd$URv;6GhZJU%NTaAA9^VY8_DQT9s;+i@lLjgGRqe`2NP{%ZR>(f%dt`2
ztCcgHUz9P7Y}v%cR5gAacRL(~;hIj^Zw_8B`Q;T>?{kH1ENdo?_8(ynaA{N0E4|2Q
zMSUIG)T0u|rZ#RlJfoU+8S00#kfSm#eu1qlzPwUdl=mfbKNK`!Umn^q_vBrsurlum
zT7FTM)Dfy0)>Orgf6YetZBx7?Zz^*OT=;1Be&}H7S1GCTNRK5{w&UeWR%=qzQnQOj
zY0hoW?L(}P_g8!kwn~*>fv#a_!~;lKEya)UN*N~7Ser(sWQ}%Nkeo$!D@;~3m<rNt
z+e2kKU$XX?E9s;TcXu(<CJP-g*R$@p7uj_xxv<GDgWCkUS3%2sdRZp+3k~@TrSqys
za%XNu>7eF0S5JKPoA0cnMzAu#r4u;~8R0=(o9{dnVXqC2r(5zFGXjWDo-6=DlA{>^
z!bTpvm!7MqPqlNdRs5GQ1>j1a1UNK20^nc20i@pmi-JF(Oz)97|25@IDuV<}ym-vF
z{TGY+UIZUNHB2^Be@#uJ@-_pQ(eSSt`M>`cWxyd9e6x-JmqYhL`V3S?s#%Ld|MI*D
zsIRFrKmc@y_Fpg$IKd3n%2byNAZSgf9=H7auNcS?03q)1+$!)dSd1^kOOJwFe9-Q%
zD|#sjF0zigy7jMrO)d^95XA?qlK-A)h66bFPo#GIEdSn%0Y&h$|J%Rr_s}dpQ71LT
z#l&wx*t9Kk&AzRYl<s)YgoeGTq%Q>?|C7}pRko1*b2Z*PSYZCg<gK1;oL^>O-aTNm
z84tH6pY(FHq9b^#6Bx{M0OJRT#aIat!lGSzx~?M7iI-N+KbQF6g_!B%rKP|rtx#k9
zl@5;`ZjRXdG*jn@uoWL)JS^e%8v^@V_+m0t2?}@!;=wdjIN}ekFXBeVCLQ{F+4$@E
zxn}3pb8_qJS~Q2JbyJ0=4Te7}_r&KEr2fhHRu==|<e_}h%HM?%xr}>DK**-XP>$?D
z@t$WT3?#f-F{TqQS*{k$Lx;b=gM`PGdM7oTX@wo&g1b_y<=E?-p4XRd5*bw>-wUK)
z#~46C@HO_YA7fMfq)r#*&wSSaVoY7|nJL;u{t2k>W(Nt``;$*TC;qowczP;M?LK~~
zVJN`*KYtj2r#h#{dN$AapGb0W79f{C1qz1Wp;DIrHwIiR;}T?jvo*PAB?bSLK_6p}
zNK80{M!-@+{X772Ll`UN%E^*;c-~y-x`J@xLAi7mJ==8~(0)z=<wQKoWJOgt$>VM?
zV74O0l#pG=0?0F}K^*EQnF6H$b`HKG5}tCGU|K*G@C;}G3GP;;@O23gaF1XB1QN<A
zR;u#o`tY#IV!SM7?bSmDEAlvy-p#D~MJCq0d+X9in@<?wJEnc1MrF4YJGkghGVkHg
zj`5`B@*=yh(}kk3b?r=Ve-<|LxHPMoD;IxtoZ8IOU;da1C83KT+4+jV1%|jx`W!^h
zfuW-s7&;(d{}!0RPzKxy<5=A@SW%Z8chd92((!e^zH|I&=w_nZ#_suy`6W34s|Maw
z<-nt~Eru*D4;h-z+dm!8_Lu#g00Z#Y{9X}Sb?yM%hrQ(9suB*3uvSDPh#1A0OTlvN
zEsdxbO)RTyk}n@_k}a()h#&9Povp59CL}1xn^!`fI24~HN&lUVisgMt_nx!gA(ly*
zY`i=6hAk5Wm#ct;dcTv{-AJIM=yNe-Rw;Z7aF)!irkm@H!%mRxYwkQ{8wj8;Yl%8Q
zd4BKX+hB?R0-zw3VjV$xvy*WXN`ByUz`e*-3IxiUdMrG#Z9rV>1CIBDB^cSjhUo!6
z1&D;L&Jhs65A*?z!z56POjiMg=@67|t?E1h1CL!Jna48abZff4ntG`e4CCl@-=77v
zx;4O{s)2U-TTwEHp3gLZKAiy2T<`P{hkym^*cRjs5DU|XZ`CYDIDwvOEaj<vApr6q
zXjnZEgM5nTiXL%X>=w1)n{T&Vfk4F)1QNhY{i(C-9XE`HFL!;DGa!86;Y8suT8Bov
zS$N^#U0I8xojV=FNwHOC&2I|^cQbHUB@_R=!ApeRVJ<nOkIf7xEvr-O)oAW@gp-;$
zuK%>vqd@5esOTVQL>Zy%=R(k<%Td|uEsK&=0k*OSjMhhkK=CbrrBng+QD=@!;s+@S
z7!qQ+`RJEmN0#i*tqGh4n?OTf3WjsE1Rnwa%uf`wy#VJk0IEA5J?FqA=lf|%BJ9y1
z2y`r81pJ=$#Ib5?jzKZD6M#sM87r=7(izQ_r(BJauz+~qh}pJa+*IC<$sO^p#RWp*
zRGKIp&n#yeYWYX7`-6UEyf-E_eL09VXs*Iqr7TVN0O|3WYT-=HgHT1CKi`#$)SPv-
z?OhU2&@_*O6*lFKILBgaBLK=R05e_+zOJ#)$_2*sDK<XL#6S4n9ll*HGW(G!{&8Xo
zjHFP>fA#R>7A=Kg!%)y3@F5L;YF!Lp<>~$~JP!tnluuNeYsRx_Pkn(^g7)l4tOg|-
zVdu(nw(+YwFv_rz)1=f@TTM@(AdCau{U#WS;k0l9cmdnAEim<@^^@T4x7%o_hk1Mf
zqu2(5mJ{6kb6&T#8Xh|uB8t`qy=^fvq`{)w1zc_2d&UuKFw6wLgjS$j5Lan7+%0r-
zX@8QsNXJWTG`Z9jJ<S6jZE!izKgb7PrT!$~(M@;0o}^7i-oOUp>c#TW<qrWoG^I^N
z*N<WrX5_~`*-*`=tg~iuB09k|%z(0yV98AAVWzxZ<(OI5a#u4u+8>*ioN&<gN-`DK
zWplJJSw9b#yW;mkdG?GdOTSLk|6bKj<3*kD%&R>xXTP>201O5i@PB4Ae;A+!kCwS~
z7(>a2f$<)xMAlO^dwjMXF}NmO>m24IEaoGH>iVN~jvI7sg3P{WG->V)T%z&FOnWu1
z0K8E{nS^!Pxre!x=(PrngK5^$oo2_I<H1I(K_Usa7Gr~Ro-}QCl-~3m&)J>2mbood
zojn@5LPs+@?x}gt2KzNInIycT_Ni{`YBVODc_jOU!=Y~N6+zxV3#~esd!SE(a0yHm
zPn(0Eps};<b^5W+-6_y*YQ*N+3=dq#3I+MNM+H;#m~+^wvM7O=i&7^9HlO+Cw(h_C
z1slNJAx~Q|3^=jeo~jKVTYaN})ci9+^%hMH_I!S?>&fmICvjA;2p<y6gDMgGmGa=q
z&J-T~Y(|FhP1w8a+YtGkiDJ60l50k5{>p@zAoaW2W$tJ?d-G9t^nZP!P19-*r>v~V
z?dubqAJeK~C$!NoVz-hufUmC}>n>XcEXcj^(LCO>R@yL>WpAPDAZ3a7IR|yMuN{B=
z%#RKoUUDD#i640e0u^?;(MG5ndOZZtUrf6sBU3Xs5R!7rT?J#V#(D_|NR0(m1H(bH
zV96;Ub83QbV+u>C1G7??@VYoJnj@{uUHQk+5l?1dt%4aumBk~$B0Si;K76>4wVqie
zPv3l0NvhR;RRUQfa_gM#+9%9+;|2Ynt+taLk@!Fc_oVl^chC}0$-x!d&0PU4Kst}t
z#!Kn=Q}MV3jeQKPGh3p(V4x7XbHS)HLUl}mN|Bj>O-C{pJc4{fKhPx)6Jh)NEc|%(
z$^<+C<>$YYkgtQ*K*)U0_oh1!+?c0Udpu(L&9C$L^>4tJ!XvONgM&5dVK<Qd0=Fqy
zF<skf{Nel$I>Uz+F)v*6Ish_k49s)|(q&)_kY>HpmKG8E-nd_z-`CUmhC^+nGH;O=
zaLJ3~FY27Lp9va187%uKdc?YhN-7Et2B%j3e*eM3!imI$*KommgqCLDB<K8?LKBHb
zXQf0@px9g5@!3OiYRU%eY~Hv+j5g6|=g)k8J+dm!`_Hvp^(dy|>)u$%8^PxE2xWTe
z^Mg6#mxT~Ko|PMPMAXg>;IXnW1>)Q5uwwPg7QOneQl-B=fI~Rg9EjoScz&_16k`0g
z{C9ODf`QYSV8YkQ#DL_xp$_toX!T#HYEjER?OOMG!kfzXUVh-iaOxAAHubVPzmwp1
zm1%ws2_L|Q8zj=qpRIZ$G<`LwXRDw6yte3|(!R&uaxdg5Tim<Ua1Cmx6ry>riu6)k
zW))xYu?mt{Mlb4XOE)ozjf}BhVGGJDzYkDGdUSkCUqw;DNc?x@@TYzd%OC=!RVadN
zJ*e9L{c{Wa@G-_ehx|D_BLO-PRjxi*#1v}|;itn)z7B~aW5J_1R!w6?%!N2*_t#(k
z`4vd0QZmS<Z`F~yiM=6_($!n}rv)ncDyyI*vE7Mh9~M<k_~+2<7ohT#Rd`8<X!OjB
za#g*?=A&%7(Dd%WO7st%3E7Kzs(%VW?|rF^*B%w01bDO@al9?4cLDncZM{?SqpM1t
z$REi8kQs$Ls3?3I!+MqbF68&+Eb)LEb81_+Qtq!3kqSg(u0%bn>DKuBht=SmSDkJ?
zJ3@EsKYxfHP;sXIA0GJuTMg7%W#5A>L5*3tx7b17Na#$Rx-Z3LF~%WHZ~0m<kN!y3
z7}Oa3b(ERvx@=vr2a`P3GXfW&fQx>}xM$hEb#at0RTUO|M2-wfy9#I)93xXz^cMkj
z^<#NcvfE?^F-kftus-(4#g7d(O!7yd<dy&Wv2N*(x2mrDFyNToHb#n)FH!_t>;|18
ziMikb=)@nmWy`|F86#D9?gQoZn11}b92`$TfY=nDNvoJNS;E7JdGuP4ZYp03`x+Hv
z#y^yf8v~?!i1G=eQqCA4Bb5u?L+gfs(oPSE#y*k8gMng6UqO-fqFgQA$)Ag@I{{@!
zGii3zgiN6ySimQAKsk`DZ0uSWz4~F(*D#i8>l&59b=LhvTOz_6vIOsKdqi+{GqMv1
ztP&at#KfPk8VEkfIVc?+UU@|8W#a)z@lB|7k)&{G0~4RD!LpWBq+QRWnCl?m3-+WJ
z*_dp8C$hN>H4PzULTr{LR<=DAf@9Zj_}G|=8}?t?#A?drHgJSGJ~}fOe-TTr3b|st
zAgj7#NTf7nwMQztDD#KPCtt#aLYI5uCxIe#4ZaA717o0i%(+j(-I*hsyb`Teqhq`E
za#NuMYo^0GRCA{~_kcKFQgQU6ETm3Xagd&LvGKB|-|!-52w7;hh7)TPqe=ItiB@XJ
z2URVK7}cMPLdvy@la#PIgvC*1Ujo(KysL3`x88QnW23g^o$3uPSJc;iGoK4qXx@W7
zFjjnKl?r$`DXFlS-BOgK#`mPh;YXL#Adw+JHGq=k*#K~1vH6ocH646V4@M7KfYPT5
zERB;uAh00>X-W$;tG_^#?nkPvb<M|0K2EZ$yTB?Lc7XY(3S7?wB*-0$Jc0^QD4S-a
z+(iB)IIza^<{Ivi%I8=H{G?sO2S89=4Kx%3m8kvGz#gj?O33cy=n9IYBD3MoJh0t2
z&ZMy~#0F+yi}zhY%}`{w-0cJspT<Eals0w=gwdorj%<c9yt_&J<hI{2$1MQc<OKZa
zd=Vb>Y%M|Gpt}5O4lUhA2o#puIO}epxE%+>@3sXLFNylPW0|+!KgTEqj4Is3V7{z2
z+6&(wZB5S!(69A8kXhRb5q~rgMoZ~_sJL2b4eCp6P*NL4l|U6fprs$ygJ7ycFh4K&
zXfu#wE}mxX1SEX@Ji3!fWUZ-1ic5T1d25wUHc1WiB~vwveJ}j);ZKRJg0i*>l(j#X
zZ_;lrJC0myw3{z8&r#=_6Rd_m$I7PgmJW>VU%Wa2RC`DG9r!GmoUk)NaQP!GbA|kg
zm3v~Cas;te5lAqCZ}W~BCtF&8lH;MBTNv5X!6W7l?lXgjwr+kM1RYD@`&f@q?N743
z0D6fUN}+`*g#s1UjhV0YTYz)eCKIK!Yy9|?j5I~*mHJQ4`Zvvp8>7YP$!^16v?s}}
zffyib!y3+fwt%`)13b8q;>+_r_bFY0>^y$avH1>Rje&2Sj%_=>l||0FCY*a!ni6=h
zJ$@=m5<BaZfP#~FRc;dmv~%?t9S#AJrv*8mLlD_TN_6Y$B%r9;Qj>YvOJ~(hQkVA+
zZ=xDO=MGQJd2^jYnbjxnA?$99iQtk`o?HBSh>WTPEC7>nnpUPj;F|`K;XJO#78iiS
z-jXZP3d3px1yHf$_SDnC<TFsfjUynF%^}eWmxg1tW0it?Uk2)lukQz5DpSxT;l2ay
zm{uCa9uUv0kJvAGf`T|@ZmDJRlQf~KupdSXK6S)<iC@>VH&?nXO1{VeXo)93PrH2j
z)8)k=Z|)Y`+fi-jRP&z8vjf~032(`q#`L~eEkzQ2D~RkAyX;MR+#?Z5kt)@XNaGU>
z2a;=ZAoPex&L~tXrHO)%20NmV_&tuk!?qn{W<6hab?#7mdZ={@R5DCY)aT@o2u1@@
zO!w)vkJg8`z=a--6ZwQ`{(wvZAFr1e+=0|_qVZyT13m<VQf5FRR5;15Oo|I~ixemd
ziG^jfu=>D9nVxLO3CBV}F@rNLKK!gL)Kuf)Bj^cgX8Vt&%O{KFppdm{DDAB=8!t2Z
z*!4>BAV)q6&U)thTue^}n6IzpP&yXRDJYkqy`ugFSLPSFRK7yH4u8r}H}<|g>}_AD
zT?VVi>OM`1Uls6OTZwf3@GS8JS!WD`M~_#r&T*r5`X5>u^m^KMuyj!43J^V_rh6U6
zIb7#x4mGRVRzarcPuMVZ4S$v*Gt(`|tRx2Q#mmh;3I@SxJJZ=H&w6b8{8}kPWk#w%
z3YIE&Q&l&4HZ*osj;Q>R*=D&AtZ|vF%OxyW(AgPK<fLeU+ffv`FL*uA1=ladh|4x<
zz?Q0g^=V?|mN!&oveo^fX-&2VnkW8Zd>Uw1uXv6r_*2{FYzZms?R^poT((XyDm4<S
z3W9B$QbTVMA~gg*3uTTBOu^dHI*b65=~hekFSft~wYpN#v|JWY)p}o(LH&8xK~cAj
zd+!Gz%1RdRSdA1W_R}oW6M8f}0;3ozA#{XwaXy$!{~aTmw^xT7c-!PqisyumHb$S&
zVOKCG&W{`Ki)u^|G%k}?TGwf19v^KioWFO%&b<WMmAWpklfgw>iQPGE6B+{US@uI(
zismoc^?c97Z{CQT($d_ezAx-YiA%(Ge29zt7^xL(%*)#{98tmLudncoiFyNtjI``5
zsD6QK>z^}bHk(P4hfUq(T4uYYW9mn;2)>}JV$xZ#Uf9TR%{S9_t98((e8E3D6~Ut!
z;|;*7_Iqzjh<?y<JDM7fi#geByf*krLV(-g1}JG{)GKTF$bko7q|`u?K1cZc7wr>?
z&agi&>|5|2vUtg|mZx&qD=7v*DZ{mjAfIb(in}TfMnLG22?w1sWL>9l?dB~$`1T>(
z-LrAI#(>6Kfr3-tZ=PswTY4;WA2avI$>zfhj>yd|{$T+$)VWHLnk^s<*^bmaoH}k>
z?D6lP?K}1%VmBX<l1>6Hj<H~heQD$T?&lBmrY0n%Y;5l*6$jpk!AdX*ABqwBq`5El
zy5?k64e7Ay=uqvi#b*sh$Gwlr@ZTVvT8WPyZqA(_s^+X=vl`DmO4nnvy(ks>f{9w*
zTpvWFhv?9PN?#L<yLbmOU}t)Sy(g5JlS&AyRxVH>_EcQiAf17e;|K(};s=q7ax#$0
zQ~3~N6}!*QvBHOlJA|e^LO!GEG5I0QVT&Ew_6WQc|2`QXRp^QJ6qYgn$B6B>0lv5}
z!Tovm?hoOz#~;6@@uzz{Wnv$p-rfDhg=*45!J~`W@R6mJ#P((5)<h*5z3!^3Rw_&?
zf?v(=7N>VBTEu+t3I^GX=XMem-{QVnZb<_EVg3#6i?YULHPkdN27WiW`-IPvGQ`8L
z=A7bCZ%Fu^3Jv5L2q>)kauo^sgvW`3CUiHt>AhRBa@<A~D{;J2sJ%`fRD5eXzlTW{
zK(s)>QcYbuFh4IM23dC)emYU`F8FlaLEE7+{h(g9zpFBj+8+Ai*R!APqpRV8B*lb;
zh*meW@6=Whd;OD<hj+7aJ%i^3b7f&!ox*OD(cCD{*(@q-!E)fd#z6ZP#c{vg3C#9g
zCGH6A^nfMo@;u}c!=YeVe{Z&c-AAwH1WUf5=xDcIjYi|UT4GO9bnmPJnTxHcKf$Uz
zEnBhMqOa8(yd|baE#nh_vcSVt%(htd#9FBtjSz3D`H+RyCpZg(#BJAOQ9PTitzF54
zXpWrjGN93z_&8|Irryn?eT}|}J>3-_<(;S&QTj9LwyMmPRJj|hM@Yi@E5W%BF$l4>
zaXKVJ30TRVN0`)nc%t&EL$U^Q7wN)wyOodu^J9nhT^-k8dVGX%<Tz9`_mGaMKvItF
z1-h4D5nR1RM=c|BIi`R4EeaLeIqjD!3mazjUh&P#^)Z76o3xD7lqawNFOPO!&olcT
z-S#gB*iVjqQM=+%84SWXSRy1_q6SMdQ_^`Qd@+%7qnid}D7>4di9f04yu|Ttcqr1q
zr5~dCi>R7?Ps;9MA1J_W_EP;2Y@(LtMJb5xk<1g_zGu~g6WA5ZOO%9l3@gzs+wTkw
zJOUZ4^K78WpUK=8T@nNuLbhICw7Y~D0-CV#U^MtfTl<h}IEpg$HlBB{E{LbZk)^)B
zmlPBaRJvW-KWo0(b7GLVEFOu<ENoHpB#c?CceGys#1f58*Cdfh&5zg;U0x>d`6IMA
zS<O<1TBL)A+;{fcZo9X|NE}f+df)kY7sVKUdq$C6X6|M0>ce=g1$_nV2Q!`V$hkpE
z;;@U-_TxOBN4DpnKG%{8?DzFBB*T%H?iE_Z96_NLBf`a5_Z6Y}LK;PCMd;W@gsgbA
z)UJW|{P@7ps7#6>icr_$KqaLi3trS8DKAR7%R&P)t@c!_d=P=TpR2p(96?UUM`Xzw
zyhuBRO!k~Zzii9p6@?xeiqN*2jYsoa%2n+1RH3KWr;F3?7Ccae(b8Qz*|!t?spSyi
z3ssX=8~gKC$VboS7LRguOKSwC;7!+PAPw(*oBHR*WjE1Yp4C?qo!R8Mci>AU!1=MA
zh}w8zOS~kJng#dZ5OnuKrZ7QrvC*N^Vzf{^qvsdCbCN6P$7GAK#Cy`A!4V$U6DQ*D
zGrm8&v&1x6m*;@pNs3736oe;cI<|YypWU#T8^%zQnW7LKD=E19F2`JPEo&r-a^{u5
z&t|mOHDv1&GDceDZ`sdIx7;N0sN4oCYtBDS2x~c&9p-nV9Gh!V(rx4#8kJM(@Cd-y
zh?YCT(~WxK#8;kEzJcBMC9qJnako7Wz6$1|+l~orTUb|1X;3<n*Q!_ABDCP@Q3M*v
zgnQMw;8u1Yx_`43gJDE#HY^ZXAI^DeQNppeh1YvZ+c;n5VItxl&pWV{H(iJF8#4+|
zFFpdhK88D)!1mR7UO&T1vx7yhpx(8OL1y~qrI?Vdfv}o{Ej)WxSozAGuN$Sh*?P!i
z9Ou1BoyA$fp}@m$UHmVld}$Nk8@t-d<#cr)(8M+jmF68PZget_-x-e=pI$hozrS_A
z>gnb5YV;<T`gPYa^Go&LS6m|4ydQm}#GwsKycz`VD^gXV$%Xykjh;94W3!ryV`uI`
zMayzXGgF3+EOImX=k#Bu^TDfhlCHS6IM!Zt;<A^xeoA%U{o4WI)JLkEX*AO+mr!PA
zHQntP+dw9^qJHKta%=ZY_k(*{;}v6sFshn&C@;e%DV{j_UX-PTAe)A~(j7!*{o>Kg
z%|g#l*J66~)d97WOS`T?Iq464gAQ4=^C>Dq#|4X3arfKHiTq$l;)Hv>4d)RGw1B}9
zF-DP+F$pNJ!~YLy1=y?3+lcrF8R2G`e?co=D29H3w~{DfQu>$R!t!>b0%Z~A*Fv5@
zz{MXZ=KuAPBFmX8e4x?J+|E4wFHGb&niP$6Xut4uyvQu(uS)~KkV1l_se%ge-v>X1
z5FYw^<#3$8?hM0yKoEX<rf&2v=H!L4^Z=kWDVr*fU;YKmWN?EU8-Ld*_7BkY2bp;v
z4ZtY-GR<LzzwhB7xQE&#G0FjdpOYNm1N*wHl(YUuvtIgwNAUkW(Tq-E`m|`gpA6Ux
z9Y`vLYI^o7y`^A~dAkSL3hlIpJ`_#dCAD}1MQ}bg``P(frAVVJk@?9#=fFUXc>Z(`
z2QlA5j0zVCYY>-St^#1@8UUU}_fBMox9QC^xK!E9i<(c@Rf6h-RX6F2)1Sv}hz+is
zWt~O&@eN9E0%z;U7j1LdWS;L$@SEX<wV~YlPj1HVt5b^uAbM4V0863QfxzLz=Y%FC
zl&x>Hsr?dp9iZtsAoiYM`wd<xL;y4^ez8w+Sj<Zy(Cyw<(E1+9W3wgYLKxodqCbe*
z{~x3(AbA^nUkm>I5cZ`-^y@B<!_Daah0$mf`cMtEWY~2Zr+{OL%N2|dvpC(IhdWz?
zfp7^B!FFw4Dm43UgS8&;JRz0VHn|Yy1Bho_E#<c^6BVY%08y9(ZPKDg@RtF20y~hc
z#)XqTePnEYUZ6DmeU;m|mxzBkM(I-3{l9%c2@pM-;@qkOeBfVDlP$`E?-M_2OY=B4
ztp~a0;iK9R$yjCB_2I~jrWixB&SCA{a&zBLqrHXpjU~WRl8gob%jS3zx2b-)Nq?31
zZR82C7wYo^Wgy?0FLNgsuM3J5bGMz=bc@TbxeFM6E(xn_1WySGrBFwpZ-gb?GInFj
z82|In`xY-eZT|<4d+7Z7<?nmvokIIwvHuXzZ-#)_E4{wD(A=5%x&<Kqidbe<K1FiL
z4_kn}4w~Hb(BO44Xuj*gY6bdG{|{7Si(;(8A>MBy$^mUUi8WZ^FWj&Ow0yPmtQaJs
zJaRvk(#1mw?nKkajk8;6zMg)oThlmyO!w%<93gF<+a@kpL>>DVh=pFNSyih6H-k&1
z=zmM=7XEK(UG5efY{03h7U+Df%L;pP4yv0HD9fIFJxEMo1YqQjlV&4@rT{Z6tpvQ9
zJCF<ZZvnx!4TWJ9pfU8Efa4yo8+p$K_(Iem@*EKI>A2M>Z#+H_Pl9QgsgkvTwmJq0
z+Pt=5CiVL5ArfhzKVy%f)MZk=#*Ml$oCUz-aO3s4c|1WBzzB6o0atkeO`97B(cV#~
z!*u|F=ud+!pjO}S=Q%R)dFBeNG!(Slx3l`d{L5I&iXRd$HYD;;=O2}PqmxOP6E%86
zSOtjwabOLK+P$W<@8xs?&2!xqGCI*42+Syuh6%e9dduL5NO4`yc;2`>$D6d?f8x;o
zo8Mi53wI!Qc)ple_ctiguar<R^`)yiKk>0|`Ip-Lz#`%D4{<~cQM-Wkb`7)x_z9a|
zg>*a{gpv_xbPyt~0=RPBZyg|Ib7ISY%UlrXhN)otqbRerrSdyF&C@)?<RM%DF6xOI
zj)Pzky1OKi+_vK}PpzhSlX-13nUjgEJk&7|T!Ew=e%&$wD8{uxZQ!5kE0^1J0JU;T
z0zIu*GsLz78ve^Puwp|fv@7`UwTLezf1zxx4Hv}Y9(j~OTKoy%hu0T$J$9JHJ_<5q
znXapC<Gh&<H=+6QS($ltjUS|nTY~V1?Y>*lAs|Gz`G1x7-SJevfB&UZ9b_d@HiaTG
zvPVQkW~HnUokYlXkYr>YqsYiA*=6rYS%)Yjdmnr6?Zo|h*Zuw8pYP-TJs!V5e}DY^
zkL!KT^}epx>$zSQUD=>8zY}zM0!`gDRN-RJ{f4H6sa&4@NAatW-`B3^=oWR~xeyaZ
z-Cme$vW|~=oNjmW&;8Iq{)dK|3?i7T)l)}W^%myA#Nej0lN>?Lr&@SjXnI>eyE#MP
zW5R0oamKki5q5I_4wcvEdjQXxl_vP#@>xVcCLf{dm!F17t$XrQ)Don7NE@?C276!o
zO(g=LE~%Y$GbL~}dX(lF@cQv$6jZ`_!|jJdC3e9xl5IT%OmSaFkC_j5scyl;1>Rl4
z&p}|<4P>at(XPE-M-#rG5{M476HWd*K7GJNe}sL$0np{AEo+m`a~=ST=Ocy>3$d&w
z6A~mie}tgJmGEpt2abHP43m#0;L=P{ixE2e^Cp)8P69XTNy_f*l4~Q|k6G!9eq=XU
z*9YwLL<s4=%tAQnBGABdAYWENTeR7gpxJ+jE@p)^z2}+z99FDyiL6@kVPE5mM7`Ia
ztm4zNbE{68W0Y_X2G{G?Ssm5K@{9_s1K+8)wt68~;@DA7T!1;Nkf-12<p~Nx1M53V
z`72BF@VEimXf+(USW=l@k;M!Cb~t>K`}QD`R^r`{nh+lgw)8yY5^4c{w@l2YRN(Ob
z@&Us47~ug~|3C+jE^%){XHft)H>oEgg9~83?{I0S<{YH1lNG7USxrRSTN|08PtM>r
zyBQq?ECz^`1dX9RIDZB50yOEk7^?QJTed57(z2lfq=W{ELbHPVG8IgF34DpAR%2Qx
z$bl*T@qc29`EJDcqNY=C@Cu*(TU#`ck({Fa1u}t{LrV}1aN_tA9|gA5nw;7z=-pOo
zCnCVR{d-t@nuBxR>3BvQp>ACMGH%}IF`Mcl1iEsbsY$D;`HXPn4tsJVaXo(BRs!iY
zRO{P?V}6sdCC<4TY3lKDY;{dduF_5I9d546*0k>jimmh$mBzSttsr#L3A{ygy$PAt
zXcL`ep`m9A82|dnaam6m8P_vbXPgyPdL<pEH0Sudz22w_&Ag;Uo13HtaU^Hx$7cqA
zRF2QmaS%0KP9&H-CC%oJSN&53v3)@k=kezWPNObYu`3A}1>U7vj>|L&AUa!<OnG@y
zK-jjXf8ng}=_=*xcu4CU@!@;YHvA5c0O56-v}OT><vK=H0}(0`O3-r19O!;4e+ZF0
z%>hv4FuwYhEx|(iYkxChI-G}l!*-WigBj!V=ps8CYa`b_jQr6Z#RuOjo9`=eUi|rR
z;G=GVL7eDzs!+8;L)7M-UzF9?sTVS4@UvU!Avgo5;-cckr+8MsW4*~nSW=~l4czVr
zuf(7uE**p!GKkMQ*W`s)x%}+8<okv8?+<0wJGs+($XovhnGR=SRfE0&QD1T^#4n=6
zW$8eim<Ra|h!!00Qyn5>nW~|#u9fGESk6y?flOB$NNf|a{xoCgN38UXvST-JYarQ}
z9?4nO90HdbKa=-7HovdvaeWeb&sV7su~?#i+JvxW#U<484j3uRkCH22vD}3Cip5vQ
z_vCrVp5VVOH5~O&#FvCxRbe)afRS|TU<pS_uMXZ&6IV7EKzqpZ?3TE&&AdPMaO~P=
z>YohN9xzxZ7jk||zmd^0$oMcQY0RpG{~@MbbN=tdwEuvdH`ercM6HDa4_4byTwU_~
z69sOx>F~P@o-5DomMO@7r8`tPO5?7(?gv&57blI?$4XEqYGH1f&9K~EG>(B~5`sCk
zl0<a}h;9Y%dry2%#LO_`xXqXeXJjkm7V}q>pG&bwE52F0bDNTPqC$@?AyzNtO_pU{
z|GTsN$=+1V8#8OJmCm8P0!Y#3qQ>?<!Cd3y6KhF@H*46W?VtjvWARpj_cThc$I+er
z^1y2Npz>az#kbzrkJi)vkBp+yU2j}>lic~POmcWJ%<%WF!{!aYx`3DJb;<uGt0lGd
ztmyw9@m3@$9I5t<@ASAyI5Y>*f5_?&$^SuCcTya0&Yby>|Ibc>L(>V${-%)6Du1tv
zzxu!iJ7^_z2R$<@|5^6;&;TbYwQ*h-b@TWzL3i+Kcne7Igf^SEpFaGzN)e{c{TeTM
za$A@t_YY0opf3A<SZ1N(sNuhg*YTIoD7ehgbtt3uI9k)SI5$USf2C=NNf&NED2#Gi
zt#lM`_!pBdeVpettJS$sio5ZOAbVQ!z6|Yy?HB4d8tkk-rNb|;UZ<aAUg&B2l9~2r
zrI(#(p*309yEXq$M!qrZd9`#SbtMey{GYPA!5UTy#;(lI|9r+%h}7}Q*7^V7vCE<I
zH*?<4*!brs2iaLBpN<heOcA+qUDszE4;*8at<aHc69N`-G)G+2enNE@N;6aE;7l`d
zL33XU#)s3%6pKxpw;kCi9M9Y<?g3ohU}llbXlRdza&%<F-L`RM_rb4dokZKPtomzz
zY3W(}!FAKpGjjA7^d5k_xw0vruP5q3Z2no$np;kv>ku|We~*{y$_7RSp{L{F<wfdx
z?p{$)%59QW)CP*sBl!t#a4Y{(y(iuSgYT^bDwY%ouMZD_-Bnu(>c@LB+dyltNSYJL
z412`DNo}HrYT(SKl=YC!7~NVP_5NTI6~(7(^8RXY;6TDR3PL_4ke`FgW-(BE3=~hA
zA2)+mCF|CwLz8ZAAe<-ym;u;!9}y2C*16(`Ki+inRX;VMP0f49W6BXcC-mllJ6^t+
zg*9bBt}3snax%HJ>Z`;f5Jg$9Lex_5mlYEjZx$}KkfC8-ARut8F_Y!^FN~7m_{3RH
zDBpWw+>RMk>jl7d4Y+R1nIrk=AFr!&sX&_-D_WEOv|Em!%4Zc~h0Q=XS}X&i(auVD
zw{i%{CQk`%3@4+*xaUhI|0*rbFHM(*Q+D>j%aBcxc#&_tr|vo#=#TbZK1C(H^n95-
zOg;#BZQ0T%?RNPa_~1}uS^vpEI^Iv8HWmi@kk(5q)%}f4`RLZx+EaYTxwyMFi4IYt
z;&tQ9QG-$RB{J6TT8#lWW}DR4Pmv6!-#T!Bp;%c_{`Orzhn=sJYRpM|{EO*@RgPM_
zbVc!6E}B;j%17Gjvo!7ufeN#))OOTMx!>+YS}Cz+KKKSb-<k9K!%i2XE_gO#^ea^8
zJ&7DkF!=3s$q2}5Mf$*DoCO4}6T(W)mO$<?>X>@A^MK=B4&unaxL>Qu2YZmpt&^hi
z+7fK04uhA!aB>?c?sy$0p98P7<2zOefDw}x1>V}ud|U8D#W|?A((}G+MEY5Ql2x7U
zl68OgZ{x<7*I3LiJ?<3g4DW(M+5~$Bm`01V1lP<<mffwGsvU@hse;&XS~0ER@Qp#F
z5;nyj>jMJUfLV0t>1wy60kF$XFz>4umi~a2OVuVpT?ZAst~Jj=(Z@sOn-*sm7<+73
zO(A;aabWv8OwGI0I}vQ8520YfRuCTJ@V)f$5-eCEl-E4FY~pku7?+rH;GOEvOO*4d
zeB1(wQupc3-?q_Jdi~?bih@J+E^ti6aAVinvCBA`;fw*{&4(Mie;sOD(l4-8y4>4D
zcV6v4G;{y(-4qqN5`lfFDeKgHq8a8vArP>RquB|1_Rg>{aUN;1SCdz-$gA#onF{3D
z8+!^?iL-?Q{aspq!I0^qI^s(HU{IFN?9eLT2^Fp54p-Rg*xOgvY3Fma-uphj5%z8<
zYGWU6OY86KwdUl`x4i04IO{=l5M9mVmK}0|idK-rR*d4a1j1Y3(Yg>V*vd9=SXLmT
zeQVm8V<fi=4zrKIRxXqdfWmsfTItkL+xkb!tgO)Gd}5TtY2XE&PcdABrM%d!N``v7
z6NCmBM0Snn-PF>dEVJGPRq8<A8gTPzt)*lur2N;I3y2J~zhyuLD)tZwg8*iHv_E>W
zJMaDIx6(?mo8yE|eVAt1gvfw2UfG$r6Wa86?balG6SM;}%}+p~<2dTS21t#=WXy10
zwTpNlO?@W>&o6Q{#NCpR^9{Y1O+GjhQU?Ju-N6#g;SA0`*5&h}Ut(pOo<EoVg*k9f
z2}JNd4`HBEeAvbbYF-F`ir$}*rTHG`P)2Q&cP(Q09dYJEPTa+EFbE73Lyd5zT0q=$
z2$=GP2Z+X1Lf$uht}P{~eCpN)h;a?}&<g4k{=)oQ_xoT}f)#k@3&EA&GA;qU`V~H#
zDtR8Z1o3wz=D+YqC{9Ooy94FzIIDbZiqyAs^6oL^P@8K8_iY_7&tY4};G66uWhNxi
zb@8t#<<egDeqQrI{h0x(OtZ!eM9f8S*hD6iULh`bB`J|RYb8BZOcGmp%m2}+0-Lwm
zZLc+{(3n_a)ALN`%b0%}5&6`~6Ysk-(H9e@Qx>{G`|t!x{UUI7>N|ZscvO6FX^p9j
zp(cK<<HKEn6ALvhdHWDcZtu=~qHXMkTxXVkS8#B1ycD<eHVD3Ltj0#Z$J63jzK_l!
zg&i$tTP45`+1UW{6vReI!?;Lw23s-TotulsL#S2NPL2M2Ga>qiQ=3B|35+WVljS_)
zwId|@nH^pB%ZnPy)0}d((C0NHE9#wcbM<F@#UCk79i}%J_K}=J6yKXcDRZHk>!xAu
zfkKojvs=b(WQTeW$#EUTad!%O%AaUUgirx$HJjfJ@LI>wif7-_?H6p4um<eO2~M7F
z=)#R5SHyNwf-6>bV-vh~cHts;C#?`SqqHT7bJ_f|GKsdM<NJGy`~4Cm^;f&H?+x&e
z(aYXpnAO5Du&TC+dn`hSs(!tmx%>f(GhdsA<to1HM#5u__m;9}Q=5FtReszeiCbIZ
zNy|qx-J}B2^!_A17nTeB%_Fx*t8v{|-x~WL8u5`Jz@P35ux%Vo-UIE3IJ<u|o;<`x
zzIOCfb>9gL)>Hrp^~v#xvCv0XR9F7wk@vwAjCtuh&-M`!bJmc>hpagIfR!?1{(GO=
z{g0X{T<&Yj@@^5^Qhug2PnJr`zq{6ciXXO#+U#Msi}SDxCo62K90?fIBe=E)d>%og
zV{gJ1$3<ioV60erI{Gto^!T8_7IUa5EvwH_ju=u({MO}KSy1Tv=E@M4YG}*Zk?1o0
zNjmk9d^&IE*Qy}wVrFHGcDdGvyvF{9RLpIyE}Qg#8*5!2g#nUaK54EqA311-`x?D`
z3Hl{B$oCsqK?3=}tzeh=j7<30!uJP<^3?X2j{2MxWMB4;a)bih=A(FOY11&bTQcb+
zu!A=JT1RLv?VMOPD6-IYHbZHM)N>P~uWw1wPe<N*Q-9R)s-_3%nHJO;5`My!FX7Oh
zXdCosBAe3CWaqU#1MS)7YyBB3g0<FZ{`*gdd|Q<IGmH&rXC}DEagVnI@iYl*+`s9f
zt|{8Sxbvb#d3r3|q5?(kFL~#cAcu@|WT{)kT=zOg5d>b-1w;fF-<~G#I75ZDIhY{!
zB*88HSPqqFKHC_HKn-GFMjcc{(@Q)tC@jlmJK|lk<c>W&t<y5EBW>DWy+Lnd-D9_W
z<@qRGy|?@``8-0?aw0a3`h>xQ?V86Oi1>c|p`0B1TUGuF|M9om`R=*~($op<2Y-%t
z)pxL~OzjZe2MJEw^8}6B1LMOP8@^F7azm6~D$^5z59W?{cXxB&tuc5te$WG72ax03
z&P&;9bU~GH(9uxRR#NV`VJ;KP-Fmq_0*b1np0o;m+L2xEdx@vuNz5}hEMvG3%hQ1m
z5d2*d@{KORtol?b`9ZfGrqOUYX&0@?kBMH>GBv}Jk;^-r=ospYq{mLX91Z0zeo@ai
z`*d)6jjEo-*=e}>-k}AqW#-hXJYRn*{Y<;3+p_nt`>&*B8)C~v`!m@318j10w_R<%
z8^>LH`UML4HkaI*UDTJ|Wm?&X%Li!hD3mJn6<ft$i~b!gB6Qy!WMc7}X2*q!*a}I=
zCkb~_mlJcm_f;b`K7r~+C(%O^mlQHE?8v6OhojNmW?$ND|4eLGzC`00clLRdXV8Tw
zdc!8ou`)+aU@bp8_lPmI97}jqA#b3FWkeZr@H_a>4Sy!wVYMyT%cAqY?Q<+gQQ_?<
zGhV;`1$8Jdy+<S|<}!+wqnb2kt16d3H`1BnLC3sY#K7U{I!rq572=O3k1{s&*Orbd
z^xm?r7*=I^)p79W{1xs}3~O<z)8SuL(ccctk0xn!ljblhHrVo>T1=*YRrQ-Fbe|7P
znBwehM)BMuk7O><V2ZMF-60PZ#Mfw}ui~i_E)P{A#Cu107zvjwwxi;w7<Phsq^hqv
zq9w~sL0qRrhfS{5Iqv6B|0}A~By=<ZQLmn+^Nt>`j0h6vZUOcAP%u5-lqqp!?N%;7
zMEr!3YZ)^q%)GUgCeV%RB&jp$S6vJ<){Fc#4NPK!M=cdQKlV|8@U<=W+*49a*J=y!
zYBxt3&;1zn-VjPnCuh+XcjaV>+Z!v2QXP}fuw}Bhw5hxwQ%qnm?pIRNY~Wpp#z?cr
zZJv+D*?!#7Jik%J_#+wjOrak?F0c2**0kx#q;UMxSFk4O@Q?>5>v>A4=GC0$j{NeC
zl8__ZpNw7$pRsu}>@3b5`~2`Pi!v-CQLa~W3%Hzzw&CD9@}}>-^ckfsl;Jz$^uq}h
z{0;rqN_?vaPMe^Xy{{8Q_lgcv(Q_n}P8~OzqNw^lyMg|8*(ThVoSmwDIX5CSbmHAL
z7VG=v04h+)2K*TJvI8VlQt<2S?oyH_cSWfG5yKZ(na<CCcA<*gZ|0t+(M{%z>~lkp
z&V2Q@z%saCTZ1eT6E}Bii<;7E7_aM_i_z1_2FRy0S7e};X)%?1bD?aU4?M+gZ>?+X
z`gFZ$dRRU*)RpLHYtTJGQKhhrqi+*lHtA=xL4RhG6F>fC;Pdc7!CH=KudA^%oV6QA
z<`FG{?T`M4lSNjzOAD69Rjxbk)bCY0z34G*d6eu*vP&cH^meETN&`#M96Y2SjBnD`
z)q}VtF^S>GY~vYR{&Jh&Y>R7%u)<p`<$)Y_s!uLKjZ)hC7xSuyn+|266&6Ht6GW@S
zSFoa0a<}h9*r}{;J*S^!YG#cyt)Qu_#+p_ux?k+|>xwQnV)`YH5>Is*4qa8~erlx1
zTyW7;^=p`>NbN<8NnF>k(iiyCHBUx`Ei7GtS<YBd7Byrrl5UtuEMJ-@pJ1)`7l8{j
zBV@pM$9PX%yOb9twm+w6Q*M-cOi`*UW~r<_?Wfr{>U7NmdYfb_zA1Jzo*Xn^%L!Lx
zMw}Ey2uk?JCqydzvAShj$);o8Z^=&Y+P@>6WLB-2_H-{BesSS^3$jnzZW(z9-q$x^
z=Ajp$v(k8&G4nj_JGtVDVtbki3!i}YUR5Ds+_;BeRkf&P;MMo-XefVwMHt1VZvHc}
z3A&;<Ynh&?l^V>hwE5Ab^L&QsjP!d;TS2@f;=dJ{c@7DNmYTgfg@J42^@8mcmOnH#
zcBU+xc7jGbrxf|{h7Vq@_*#3-w1VOV!&5E?oh_YY>t`}@hSkZTeiv${4U)ckERlu2
zNO$zS*Qu-eTGra~g|NzNjehL?FX^jx;`?mxmqhp7-9rX$uWw?`NLjm|cF$%7=5T#9
z?ekv@p)vY^;BV~U^0C!S1>GGKR*GUVY?6|05F_C5IT~*o-?(($o*Ng&AA=s_gkO9*
z=UAkRz>IeO2iOH_H+Q>-m@M@0v0j@Iti9~*eAuIbM<rbR+x>ho6&&X;qw=Ex4ms(Z
zkolKp{7c4a7Ngb<nDngNo&G1}psR{lN~JWk|6)FWu^JwIz%ejQMk#-7qW{fu3nJv_
zg0%L%f6~5|2!naS<MluPQ&=6m;02|tw;lfn8lm>gKMS;PF;V-|Ke3UM2(~iPe5>O>
zu$4$y{{LR+TRW{;+5eAd?*GSpe0p4X)=h+tS9$Rj$ihD)`}XQ&A3#Qi=P{XKj--~k
zRY!_{US-q;5C@F07PDNfr~mS#IGXg_;;%xH<w5|DHRytg8n`;$flrQBFjc7-p|~ye
zo7`#;PYT4v1zj*GZPhEWz94^ZP)c<jc<+XDumL4H;w^A!kZB>LM)ey}D?Qg2naRnh
zc5db6NAHnc1i}lGRADden83>mv}}ckLJL0<so%;?(f{=-U!JCEz<yr?6vA?C>SwX*
zx&^=&^8k%MOlkWhXo_dRm{Kr`7Q$RFd?utvpT~TG7A`v;N$1RnNK;UJ%ZH}s%xVqE
zXJa+u`u(nZ9V^?*fgrCjY?{-(Bu$F=v292k?1M&ml0}oF*lw!z9l%njxh+XM7Qn6Q
zW}GTMn00%12ylQ6K(5R4LCt>!(cxQ-H@+^0iEgQu)|nMGr;agP{5tU?*33|P2-<SQ
z9Qhb*-QpQwENZ5PZqxS?0Dxw_;k*=DU&d54GMQlwJqm253DYscX1#!I%_F8_2mowY
z#;$zho`=zS#V~EyXyIT?04?_?zlZSUU=ZBGoI3x@-p&U%AsIAHizvx!{b;D-Mcb6-
zS^LePCC-H~@rJDGTkt^6`T%7ZY|Ao}#QHgl_S;-334D6@qYh21*x-Vs<4ozN+(YXK
zE*~%U2&^JSfL`?iWb^6~RiAE&MaOyl3ao9?y@-NGKRGs+B6EWF*N)AAGQPpjQB~3S
zUtXa<$SDsiN{B1<!|jX_J)N?ZAti@}{vL#k20EhvaXwnr+y911Kz-mEHG?p(R2djn
ztuC^XnFg76jif^eBm__?25cZUEW^+$bt93F&3oU%oTgf<T+;j~7$;T~$8L%aKE_ob
zSytR1p8zsY!mlGHJ&V|vFX-miT1ibro6Z3(Qfv*3>7v{|v4FM%AS-99X@DqVufy)C
z5rv3YQ#;S)3GXYE5`Ux#UFxV+XkEjWENX@!eA#w{(FvjgGFEMnIo`hY0UCdH;n-=<
zgwP5L)5_mJ-&p0pT$h{V`A|@mn6sr%++}rA->(u~pWN=eKReO68Bt@GHEj_J(ve8o
zhVDcD6^juJ(}<P<1P5a%5tacU*!w}@x#<%v3ynA87j|Nq0ZVo@rPSQT5(>e<T)h2U
z@Mb!aIq1u?Y0|&A`0LEBWmk6mj|7=MmvFhQ;X~ZX0_Af;R}RoV_WwEn+<n(K#)E2%
zOK&+J(){#3O66p-1t^@YU=M=TnMh?mt!M<$M7VLJLmN9KP`PCi#XUHI7#HV7pAoU%
z^3dhp+ky93@`$D4^U?7rgfYLIO%p9{pH18LTYXW_rt7C=8?G#XEC0J>F?+ExFCuI4
zTv7aEAGUabWdgzSD#zx0UzbbDa`no^xBK@!0TKDsdKkFj2pg(uu`TsSs2tZ7b~XfM
z`XM&d-*KWvXkydZ=q9nN)Ydf0E0+=_LlW)h$fc1mXHo(f@2$IcO05z2&ryDu)=Ocl
zA&mV>9Jeb_zIN-}#A>(EnhrLiw;$W~drItknt2`QNrLSJ6|{I_H*1fpD-5EE;4><B
z<bS!>#7lxZgg=b8Z3S-J^p(<7m?|ni{(#}+Y@%z^1fR~_o3?Ci+7H^F-wdqJxE)UP
zkiA%0I83aUEWZCa(WUQn#|P8TAyRCF&rXbMiO7)^LF0)FH0R$#EAOGhv2%I#a{!z=
zBp3<kxR)#6P+djz=Y}Op;@7)7#SFKA^R+j59sRiC2jmk5)7JakCxQ@$Fmin8cey_4
z?$T8>zR>(v-0=Er+xA#6M^#DS#ZzDHgI}`B`FPUzGmdM@8rtga(XbWzmD9;zxsJq|
zTXUQ=U@iLoAkvI}112|$dE!*wJ930kda@^~7v9qsE7~c#u~6?~$h;c7D(ct7oy_^j
zs<>NZ`Lz`>Z;{k(K29g+FmlNA@FFB`?Or9|O6m+8EX&0S5dW{PI!elgI`arS<eyRr
zG`#`wqF@8)5sq=`=3r2~c|F*5WG+K9=`@5#4h87XsB9@kEVpvty<cFXgfS7q&I<-^
zkQFGT?X&XZCW$J)hByJmjdLgNL3lF;a4g3pB~|J&sS)nSI2SGxY5V6qlTzV#a2S?}
zamp~GdRH!o{@=Po0lY5X8mT-t@$}NpD_gU(x6`e&-fXDk-0IY2ElL^+;{2!~Utwok
zC-Ovkgc6e|>wdgP;KGvX(fN;V2_;Wbf1fZIkJPO%e*0pR!unVKpYM$eA?2kru<c6|
z$B+J~i}5?MoOy{C+a;1nv|Z*Jt0M0N=(BkVFAH+lkVEXJv<zpK_6#qh2n4IEifo#{
z4+Z%I8cU<ESFC_HeyVaclBRN%zS#|oDR}^|ON2^NF&(e}4N>%nr~Tmty+WJyU2wKr
zf??neC=#NKZ1*_lP*obbwbyIBT<?L0NYruWc9h(G_Ix7e*LWs{@U78kNE;6AKUD5N
z4PL-foo5iC%Y~C}y}`G)M5q~%tbQeak{_&RZV)m%@c2CGdy|ie5YO3c{~IvxGAmpS
z3=3_VPusWi{>su<oO}Osi*4|>Mxwma+@O?x)W+c)(yXn?u|SFsT_1~7JQpj+ACq<7
z#p$(-;XFLd2+je-2PD@T^tvr>f3Wx=w!K>K@r)n6xnww%(zJh~*9U7{WhJ*qydlo$
fj?|i-LYzzcgme|T1VIeh0r*i?Qdi7YF!uT{FP^2r

literal 0
HcmV?d00001

diff --git a/docs/tutorial/tutorial.rst b/docs/tutorial/tutorial.rst
index 0de799a6e..5a0662507 100644
--- a/docs/tutorial/tutorial.rst
+++ b/docs/tutorial/tutorial.rst
@@ -8,3 +8,5 @@ Tutorials
    tutorial_02
    tutorial_03
    tutorial_04
+   tutorial_05
+
diff --git a/docs/tutorial/tutorial_05.rst b/docs/tutorial/tutorial_05.rst
new file mode 100644
index 000000000..784d489a8
--- /dev/null
+++ b/docs/tutorial/tutorial_05.rst
@@ -0,0 +1,169 @@
+Part 5 - Using Celery to Automate Maintenance Chores
+====================================================
+
+Scenario
+--------
+In :doc:`Part 1 <tutorial_01>` you created your own :term:`Authorization Server` and it's running along just fine.
+However, the database is getting cluttered with expired tokens. You can periodically run
+the :doc:`cleartokens management command <../management_commands>`, but why not automate this with
+`Celery <https://docs.celeryq.dev/>`_?
+
+Set up RabbitMQ
+---------------
+Celery components communicate via a message queue. We'll use `RabbitMQ <https://www.rabbitmq.com/>`_.
+
+Install RabbitMQ on MacOS
+~~~~~~~~~~~~~~~~~~~~~~~~~~
+If you are using MacOS it's likely you are already using `Homebrew <https://brew.sh/>`_. If not, now's
+the time to install this fantastic package manager.
+
+::
+
+   brew install rabbitmq
+   brew service start rabbitmq
+
+Install RabbitMQ with Docker
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+This will start up a docker image that just works:
+::
+
+   docker run -it --rm --name rabbitmq -p 5672:5672 -p 15672:15672 rabbitmq:3.9-management
+
+
+
+Install RabbitMQ on Windows
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
+See the `RabbitMQ Installing on Windows <https://www.rabbitmq.com/install-windows.html>`_ instructions.
+
+
+Add Celery
+----------
+Make sure you virtualenv is active and install `celery` and
+`django-celery-beat <https://django-celery-beat.readthedocs.io/>`_.
+
+::
+
+    pip install celery django-celery-beat
+
+Update your list of installed apps to include both your :term:`Authorization Server` app -- we'll call it ``tutorial``,
+and ``django_celery_beat`` which extends your Django project to store your periodic task schedule
+in the database and adds a Django Admin interface for configuring them.
+
+.. code-block:: python
+
+    INSTALLED_APPS = {
+        # ...
+        "tutorial",
+        "django_celery_beat",
+    }
+
+
+Now add a new file to your app to add Celery: ``tutorial/celery.py``:
+
+.. code-block:: python
+
+    import os
+
+    from celery import Celery
+
+    # Set the default Django settings module for the 'celery' program.
+    os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'tutorial.settings')
+    app = Celery('tutorial', broker="pyamqp://guest@localhost//")
+    app.config_from_object('django.conf:settings', namespace='CELERY')
+
+    # Load task modules from all registered Django apps.
+    app.autodiscover_tasks()
+
+This will autodiscover any ``tasks.py`` files in the list of installed apps.
+We'll add ours now in ``tutorial/tasks.py``:
+
+.. code-block:: python
+
+    from celery import shared_task
+
+    @shared_task
+    def clear_tokens():
+	from oauth2_provider.models import clear_expired
+
+	clear_expired()
+
+Finally, update ``tutorial/__init__.py`` to make sure Celery gets loaded when the app starts up:
+
+.. code-block:: python
+
+    from .celery import app as celery_app
+
+    __all__ = ('celery_app',)
+
+
+Run Celery Beat and the Worker
+------------------------------
+
+RabbitMQ should already be running; it's the "glue" between Beat and the Worker.
+
+It's best to run each of these in its own terminal window so you can see the log messages.
+
+Start Celery Beat
+~~~~~~~~~~~~~~~~~
+
+::
+
+    celery -A tutorial beat -l INFO  --scheduler django_celery_beat.schedulers:DatabaseScheduler
+
+Start Celery Worker
+~~~~~~~~~~~~~~~~~~~
+
+::
+
+    celery -A tutorial worker -l INFO
+
+Configure the ``clear_tokens`` task
+-----------------------------------
+
+Go into `Django Admin <http://127.0.0.1:8000/admin/>`_ and you'll see a new section for periodic tasks:
+
+.. image:: admin+celery.png
+  :width: 500
+  :alt: Django Admin interface screenshot
+
+Now let's define a fairly short (10 second) interval. Go to: http://127.0.0.1:8000/admin/django_celery_beat/intervalschedule/
+and select Add Interval, set number of intervals to 10 and interval period to seconds and Save.
+
+Then go to http://127.0.0.1:8000/admin/django_celery_beat/periodictask/ to add a new periodic task by
+selecting `Add Periodic Task <http://127.0.0.1:8000/admin/django_celery_beat/periodictask/add/>`_ and
+select ``tutorial.tasks.clear_tokens``, choose the ``every 10 seconds`` interval schedule, and "Save."
+
+.. image:: celery+add.png
+  :width: 500
+  :alt: Django Admin interface screenshot
+
+
+Now your Celery Beat and Celery Workers should start running the task every 10 seconds.
+
+The Beat console will look like this:
+
+::
+
+   [2022-03-19 22:06:35,605: INFO/MainProcess] Scheduler: Sending due task clear stale tokens (tutorial.tasks.clear_tokens)
+
+And the Workers console like this:
+
+::
+
+   [2022-03-19 22:06:35,614: INFO/MainProcess] Task tutorial.tasks.clear_tokens[5ec25fb8-5ce3-4d15-b9ad-750b80fc07e0] received
+   [2022-03-19 22:06:35,616: INFO/ForkPoolWorker-8] refresh_expire_at is None. No refresh tokens deleted.
+   [2022-03-19 22:06:35,629: INFO/ForkPoolWorker-8] 0 Expired access tokens deleted
+   [2022-03-19 22:06:35,631: INFO/ForkPoolWorker-8] 0 Expired grant tokens deleted
+   [2022-03-19 22:06:35,632: INFO/ForkPoolWorker-8] Task tutorial.tasks.clear_tokens[5ec25fb8-5ce3-4d15-b9ad-750b80fc07e0] succeeded in 0.016124433999999965s: None
+
+
+References
+----------
+
+The preceding is based on these references:
+
+https://docs.celeryq.dev/en/stable/django/first-steps-with-django.html
+
+https://docs.celeryq.dev/en/stable/userguide/periodic-tasks.html#beat-custom-schedulers
+
+https://django-celery-beat.readthedocs.io/en/latest/index.html

From c79eae268949ad2a418315a62324033103d0776d Mon Sep 17 00:00:00 2001
From: Darrel O'Pry <dopry@users.noreply.github.com>
Date: Tue, 29 Mar 2022 12:54:57 -0400
Subject: [PATCH 14/20] chore: .gitignore local development files (#1137)

* chore: .gitignore local development files

- venv, my company's development team keeps venvs in project folders.
- coverage.xml is generated by tox

* [pre-commit.ci] auto fixes from pre-commit.com hooks

for more information, see https://pre-commit.ci

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
---
 .gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitignore b/.gitignore
index 3643335d4..4d15af97f 100644
--- a/.gitignore
+++ b/.gitignore
@@ -48,3 +48,6 @@ _build
 
 # Sqlite database files
 *.sqlite
+
+/venv/
+/coverage.xml

From e647d51bee0685d21ab692b205dc0fa65b4c4d8a Mon Sep 17 00:00:00 2001
From: Darrel O'Pry <dopry@users.noreply.github.com>
Date: Tue, 29 Mar 2022 13:12:33 -0400
Subject: [PATCH 15/20] feat: Update PKCE_REQUIRED to true by default (#1129)

* feat: default PKCE_REQUIRED  to True

BREAKING CHANGE: set to False to maintain legacy behavior


Co-authored-by: Alan Crosswell <alan@columbia.edu>
Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
---
 AUTHORS                          |  1 +
 CHANGELOG.md                     |  5 +++++
 docs/settings.rst                | 16 ++++++++++++++--
 oauth2_provider/settings.py      |  2 +-
 tests/presets.py                 |  1 +
 tests/settings.py                |  1 +
 tests/test_authorization_code.py | 17 +++++------------
 tests/test_hybrid.py             |  2 +-
 tests/test_scopes.py             |  7 +++++++
 tests/test_settings.py           |  5 +++++
 10 files changed, 41 insertions(+), 16 deletions(-)

diff --git a/AUTHORS b/AUTHORS
index 962cc7d00..8ec6667e2 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -73,3 +73,4 @@ Eduardo Oliveira
 Andrea Greco
 Dominik George
 David Hill
+Darrel O'Pry
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 148d5e50e..baae70de8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -25,6 +25,11 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   on using Celery to automate clearing expired tokens.
 
 ### Changed
+* #1129 (**Breaking**) Changed default value of PKCE_REQUIRED to True. This is a **breaking change**. Clients without
+  PKCE enabled will fail to authenticate. This breaks with [section 5 of RFC7636](https://datatracker.ietf.org/doc/html/rfc7636)
+  in favor of the [OAuth2 Security Best Practices for Authorization Code Grants](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-2.1).
+  If you want to retain the pre-2.x behavior, set `PKCE_REQUIRED = False ` in your settings.py
+
 * #1093 (**Breaking**) Changed to implement [hashed](https://docs.djangoproject.com/en/stable/topics/auth/passwords/)
   client_secret values. This is a **breaking change** that will migrate all your existing
   cleartext `application.client_secret` values to be hashed with Django's default password hashing algorithm
diff --git a/docs/settings.rst b/docs/settings.rst
index 0ba12df11..2ac31ccda 100644
--- a/docs/settings.rst
+++ b/docs/settings.rst
@@ -253,9 +253,21 @@ will be used.
 
 PKCE_REQUIRED
 ~~~~~~~~~~~~~
-Default: ``False``
+Default: ``True``
+
+Can be either a bool or a callable that takes a client id and returns a bool.
+
+Whether or not `Proof Key for Code Exchange <https://oauth.net/2/pkce/>`_ is required.
+
+According to `OAuth 2.0 Security Best Current Practice <https://oauth.net/2/oauth-best-practice/>`_ related to the
+`Authorization Code Grant <https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-2.1.>`_
+
+- Public clients MUST use PKCE `RFC7636 <https://datatracker.ietf.org/doc/html/rfc7636>`_
+- For confidential clients, the use of PKCE `RFC7636 <https://datatracker.ietf.org/doc/html/rfc7636>`_ is RECOMMENDED.
+
+
+
 
-Whether or not PKCE is required. Can be either a bool or a callable that takes a client id and returns a bool.
 
 
 OIDC_RSA_PRIVATE_KEY
diff --git a/oauth2_provider/settings.py b/oauth2_provider/settings.py
index 3b7dea3f8..00a4e631c 100644
--- a/oauth2_provider/settings.py
+++ b/oauth2_provider/settings.py
@@ -97,7 +97,7 @@
     "RESOURCE_SERVER_INTROSPECTION_CREDENTIALS": None,
     "RESOURCE_SERVER_TOKEN_CACHING_SECONDS": 36000,
     # Whether or not PKCE is required
-    "PKCE_REQUIRED": False,
+    "PKCE_REQUIRED": True,
     # Whether to re-create OAuthlibCore on every request.
     # Should only be required in testing.
     "ALWAYS_RELOAD_OAUTHLIB_CORE": False,
diff --git a/tests/presets.py b/tests/presets.py
index fa2d7a34c..6411687a4 100644
--- a/tests/presets.py
+++ b/tests/presets.py
@@ -19,6 +19,7 @@
         "openid": "OpenID connect",
     },
     "DEFAULT_SCOPES": ["read", "write"],
+    "PKCE_REQUIRED": False,
 }
 OIDC_SETTINGS_RO = deepcopy(OIDC_SETTINGS_RW)
 OIDC_SETTINGS_RO["DEFAULT_SCOPES"] = ["read"]
diff --git a/tests/settings.py b/tests/settings.py
index d2fbe6a56..27dcfe9a3 100644
--- a/tests/settings.py
+++ b/tests/settings.py
@@ -159,3 +159,4 @@
 
 CLEAR_EXPIRED_TOKENS_BATCH_SIZE = 1
 CLEAR_EXPIRED_TOKENS_BATCH_INTERVAL = 0
+PKCE_REQUIRED = False
diff --git a/tests/test_authorization_code.py b/tests/test_authorization_code.py
index 25447b9dd..8bface719 100644
--- a/tests/test_authorization_code.py
+++ b/tests/test_authorization_code.py
@@ -48,6 +48,7 @@ def setUp(self):
         self.dev_user = UserModel.objects.create_user("dev_user", "dev@example.com", "123456")
 
         self.oauth2_settings.ALLOWED_REDIRECT_URI_SCHEMES = ["http", "custom-scheme"]
+        self.oauth2_settings.PKCE_REQUIRED = False
 
         self.application = Application.objects.create(
             name="Test Application",
@@ -73,6 +74,7 @@ class TestRegressionIssue315(BaseTest):
     """
 
     def test_request_is_not_overwritten(self):
+        self.oauth2_settings.PKCE_REQUIRED = False
         self.client.login(username="test_user", password="123456")
         response = self.client.get(
             reverse("oauth2_provider:authorize"),
@@ -94,6 +96,7 @@ def test_skip_authorization_completely(self):
         """
         If application.skip_authorization = True, should skip the authorization page.
         """
+        self.oauth2_settings.PKCE_REQUIRED = False
         self.client.login(username="test_user", password="123456")
         self.application.skip_authorization = True
         self.application.save()
@@ -132,6 +135,7 @@ def test_pre_auth_valid_client(self):
         """
         Test response for a valid client_id with response_type: code
         """
+        self.oauth2_settings.PKCE_REQUIRED = False
         self.client.login(username="test_user", password="123456")
 
         query_data = {
@@ -644,7 +648,6 @@ def get_pkce_auth(self, code_challenge, code_challenge_method):
         """
         Helper method to retrieve a valid authorization code using pkce
         """
-        self.oauth2_settings.PKCE_REQUIRED = True
         authcode_data = {
             "client_id": self.application.client_id,
             "state": "random_state_string",
@@ -1115,7 +1118,6 @@ def test_public_pkce_S256_authorize_get(self):
         self.application.client_type = Application.CLIENT_PUBLIC
         self.application.save()
         code_verifier, code_challenge = self.generate_pkce_codes("S256")
-        self.oauth2_settings.PKCE_REQUIRED = True
 
         query_data = {
             "client_id": self.application.client_id,
@@ -1143,7 +1145,6 @@ def test_public_pkce_plain_authorize_get(self):
         self.application.client_type = Application.CLIENT_PUBLIC
         self.application.save()
         code_verifier, code_challenge = self.generate_pkce_codes("plain")
-        self.oauth2_settings.PKCE_REQUIRED = True
 
         query_data = {
             "client_id": self.application.client_id,
@@ -1171,7 +1172,6 @@ def test_public_pkce_S256(self):
         self.application.save()
         code_verifier, code_challenge = self.generate_pkce_codes("S256")
         authorization_code = self.get_pkce_auth(code_challenge, "S256")
-        self.oauth2_settings.PKCE_REQUIRED = True
 
         token_request_data = {
             "grant_type": "authorization_code",
@@ -1200,7 +1200,6 @@ def test_public_pkce_plain(self):
         self.application.save()
         code_verifier, code_challenge = self.generate_pkce_codes("plain")
         authorization_code = self.get_pkce_auth(code_challenge, "plain")
-        self.oauth2_settings.PKCE_REQUIRED = True
 
         token_request_data = {
             "grant_type": "authorization_code",
@@ -1228,7 +1227,6 @@ def test_public_pkce_invalid_algorithm(self):
         self.application.client_type = Application.CLIENT_PUBLIC
         self.application.save()
         code_verifier, code_challenge = self.generate_pkce_codes("invalid")
-        self.oauth2_settings.PKCE_REQUIRED = True
 
         query_data = {
             "client_id": self.application.client_id,
@@ -1250,13 +1248,13 @@ def test_public_pkce_missing_code_challenge(self):
         Request an access token using client_type: public
         and PKCE enabled but with the code_challenge missing
         """
+        self.oauth2_settings.PKCE_REQUIRED = True
         self.client.login(username="test_user", password="123456")
 
         self.application.client_type = Application.CLIENT_PUBLIC
         self.application.skip_authorization = True
         self.application.save()
         code_verifier, code_challenge = self.generate_pkce_codes("S256")
-        self.oauth2_settings.PKCE_REQUIRED = True
 
         query_data = {
             "client_id": self.application.client_id,
@@ -1282,7 +1280,6 @@ def test_public_pkce_missing_code_challenge_method(self):
         self.application.client_type = Application.CLIENT_PUBLIC
         self.application.save()
         code_verifier, code_challenge = self.generate_pkce_codes("S256")
-        self.oauth2_settings.PKCE_REQUIRED = True
 
         query_data = {
             "client_id": self.application.client_id,
@@ -1308,7 +1305,6 @@ def test_public_pkce_S256_invalid_code_verifier(self):
         self.application.save()
         code_verifier, code_challenge = self.generate_pkce_codes("S256")
         authorization_code = self.get_pkce_auth(code_challenge, "S256")
-        self.oauth2_settings.PKCE_REQUIRED = True
 
         token_request_data = {
             "grant_type": "authorization_code",
@@ -1332,7 +1328,6 @@ def test_public_pkce_plain_invalid_code_verifier(self):
         self.application.save()
         code_verifier, code_challenge = self.generate_pkce_codes("plain")
         authorization_code = self.get_pkce_auth(code_challenge, "plain")
-        self.oauth2_settings.PKCE_REQUIRED = True
 
         token_request_data = {
             "grant_type": "authorization_code",
@@ -1356,7 +1351,6 @@ def test_public_pkce_S256_missing_code_verifier(self):
         self.application.save()
         code_verifier, code_challenge = self.generate_pkce_codes("S256")
         authorization_code = self.get_pkce_auth(code_challenge, "S256")
-        self.oauth2_settings.PKCE_REQUIRED = True
 
         token_request_data = {
             "grant_type": "authorization_code",
@@ -1379,7 +1373,6 @@ def test_public_pkce_plain_missing_code_verifier(self):
         self.application.save()
         code_verifier, code_challenge = self.generate_pkce_codes("plain")
         authorization_code = self.get_pkce_auth(code_challenge, "plain")
-        self.oauth2_settings.PKCE_REQUIRED = True
 
         token_request_data = {
             "grant_type": "authorization_code",
diff --git a/tests/test_hybrid.py b/tests/test_hybrid.py
index 3f4048698..2e85b05b1 100644
--- a/tests/test_hybrid.py
+++ b/tests/test_hybrid.py
@@ -52,7 +52,7 @@ def setUp(self):
         self.factory = RequestFactory()
         self.hy_test_user = UserModel.objects.create_user("hy_test_user", "test_hy@example.com", "123456")
         self.hy_dev_user = UserModel.objects.create_user("hy_dev_user", "dev_hy@example.com", "123456")
-
+        self.oauth2_settings.PKCE_REQUIRED = False
         self.oauth2_settings.ALLOWED_REDIRECT_URI_SCHEMES = ["http", "custom-scheme"]
 
         self.application = Application(
diff --git a/tests/test_scopes.py b/tests/test_scopes.py
index 39601ed3b..548cc060c 100644
--- a/tests/test_scopes.py
+++ b/tests/test_scopes.py
@@ -83,6 +83,7 @@ def test_scopes_saved_in_grant(self):
         """
         Test scopes are properly saved in grant
         """
+        self.oauth2_settings.PKCE_REQUIRED = False
         self.client.login(username="test_user", password="123456")
 
         # retrieve a valid authorization code
@@ -105,6 +106,7 @@ def test_scopes_save_in_access_token(self):
         """
         Test scopes are properly saved in access token
         """
+        self.oauth2_settings.PKCE_REQUIRED = False
         self.client.login(username="test_user", password="123456")
 
         # retrieve a valid authorization code
@@ -141,6 +143,7 @@ def test_scopes_protection_valid(self):
         """
         Test access to a scope protected resource with correct scopes provided
         """
+        self.oauth2_settings.PKCE_REQUIRED = False
         self.client.login(username="test_user", password="123456")
 
         # retrieve a valid authorization code
@@ -183,6 +186,7 @@ def test_scopes_protection_fail(self):
         """
         Test access to a scope protected resource with wrong scopes provided
         """
+        self.oauth2_settings.PKCE_REQUIRED = False
         self.client.login(username="test_user", password="123456")
 
         # retrieve a valid authorization code
@@ -225,6 +229,7 @@ def test_multi_scope_fail(self):
         """
         Test access to a multi-scope protected resource with wrong scopes provided
         """
+        self.oauth2_settings.PKCE_REQUIRED = False
         self.client.login(username="test_user", password="123456")
 
         # retrieve a valid authorization code
@@ -267,6 +272,7 @@ def test_multi_scope_valid(self):
         """
         Test access to a multi-scope protected resource with correct scopes provided
         """
+        self.oauth2_settings.PKCE_REQUIRED = False
         self.client.login(username="test_user", password="123456")
 
         # retrieve a valid authorization code
@@ -308,6 +314,7 @@ def test_multi_scope_valid(self):
 
 class TestReadWriteScope(BaseTest):
     def get_access_token(self, scopes):
+        self.oauth2_settings.PKCE_REQUIRED = False
         self.client.login(username="test_user", password="123456")
 
         # retrieve a valid authorization code
diff --git a/tests/test_settings.py b/tests/test_settings.py
index 52bdafe03..f9f540339 100644
--- a/tests/test_settings.py
+++ b/tests/test_settings.py
@@ -167,3 +167,8 @@ def test_generating_iss_endpoint_type_error(oauth2_settings):
     with pytest.raises(TypeError) as exc:
         oauth2_settings.oidc_issuer(None)
     assert str(exc.value) == "request must be a django or oauthlib request: got None"
+
+
+def test_pkce_required_is_default():
+    settings = OAuth2ProviderSettings()
+    assert settings.PKCE_REQUIRED is True

From 4a9039eb2af2df3409a02f492a68b77a922884a2 Mon Sep 17 00:00:00 2001
From: "pre-commit-ci[bot]"
 <66853113+pre-commit-ci[bot]@users.noreply.github.com>
Date: Sat, 23 Apr 2022 17:50:16 -0400
Subject: [PATCH 16/20] [pre-commit.ci] pre-commit autoupdate (#1139)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

updates:
- [github.com/psf/black: 22.1.0 → 22.3.0](https://github.com/psf/black/compare/22.1.0...22.3.0)
- [github.com/pre-commit/pre-commit-hooks: v4.1.0 → v4.2.0](https://github.com/pre-commit/pre-commit-hooks/compare/v4.1.0...v4.2.0)

Co-authored-by: pre-commit-ci[bot] <66853113+pre-commit-ci[bot]@users.noreply.github.com>
---
 .pre-commit-config.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 3b883f488..647f79c66 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -1,11 +1,11 @@
 repos:
   - repo: https://github.com/psf/black
-    rev: 22.1.0
+    rev: 22.3.0
     hooks:
       - id: black
         exclude: ^(oauth2_provider/migrations/|tests/migrations/)
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.1.0
+    rev: v4.2.0
     hooks:
       - id: check-ast
       - id: trailing-whitespace

From e506fceffaf9a89aca77732eb2e9de86c950bfe9 Mon Sep 17 00:00:00 2001
From: Julien Palard <julien@palard.fr>
Date: Sun, 24 Apr 2022 13:42:45 +0200
Subject: [PATCH 17/20] sphinx-lint (#1142)

* Testing sphinx-lint.

* Add sphinx-lint to pre-commit-config, tox, and github workflow.

* Add self to AUTHORS.
---
 .pre-commit-config.yaml             |  4 +++
 AUTHORS                             |  1 +
 docs/glossary.rst                   |  2 +-
 docs/management_commands.rst        | 16 +++++-----
 docs/oidc.rst                       | 47 +++++++++++++++--------------
 docs/rest-framework/permissions.rst |  2 +-
 docs/templates.rst                  |  2 +-
 docs/tutorial/tutorial_05.rst       |  4 +--
 docs/views/mixins.rst               |  2 +-
 tox.ini                             |  9 +++++-
 10 files changed, 51 insertions(+), 38 deletions(-)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 647f79c66..386d28c9c 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -25,3 +25,7 @@ repos:
     hooks:
       - id: flake8
         exclude: ^(oauth2_provider/migrations/|tests/migrations/)
+  - repo: https://github.com/sphinx-contrib/sphinx-lint
+    rev: v0.3
+    hooks:
+      - id: sphinx-lint
diff --git a/AUTHORS b/AUTHORS
index 8ec6667e2..a5f652ea0 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -44,6 +44,7 @@ Jim Graham
 Jonas Nygaard Pedersen
 Jonathan Steffan
 Jozef Knaperek
+Julien Palard
 Jun Zhou
 Kristian Rune Larsen
 Michael Howitz
diff --git a/docs/glossary.rst b/docs/glossary.rst
index c1536f801..7819129b1 100644
--- a/docs/glossary.rst
+++ b/docs/glossary.rst
@@ -39,4 +39,4 @@ Glossary
 
     Refresh Token
         A token the authorization server may issue to clients and can be swapped for a brand new access token, without
-        repeating the authorization process. It has no expire time.
\ No newline at end of file
+        repeating the authorization process. It has no expire time.
diff --git a/docs/management_commands.rst b/docs/management_commands.rst
index 3029f1345..085b130ec 100644
--- a/docs/management_commands.rst
+++ b/docs/management_commands.rst
@@ -35,27 +35,27 @@ The ``createapplication`` management command provides a shortcut to create a new
 .. code-block:: sh
 
     usage: manage.py createapplication [-h] [--client-id CLIENT_ID] [--user USER] [--redirect-uris REDIRECT_URIS]
-				       [--client-secret CLIENT_SECRET] [--name NAME] [--skip-authorization] [--version] [-v {0,1,2,3}]
-				       [--settings SETTINGS] [--pythonpath PYTHONPATH] [--traceback] [--no-color] [--force-color]
-				       [--skip-checks]
-				       client_type authorization_grant_type
+                                       [--client-secret CLIENT_SECRET] [--name NAME] [--skip-authorization] [--version] [-v {0,1,2,3}]
+                                       [--settings SETTINGS] [--pythonpath PYTHONPATH] [--traceback] [--no-color] [--force-color]
+                                       [--skip-checks]
+                                       client_type authorization_grant_type
 
     Shortcut to create a new application in a programmatic way
 
     positional arguments:
       client_type           The client type, can be confidential or public
       authorization_grant_type
-			    The type of authorization grant to be used
+                            The type of authorization grant to be used
 
     optional arguments:
       -h, --help            show this help message and exit
       --client-id CLIENT_ID
-			    The ID of the new application
+                            The ID of the new application
       --user USER           The user the application belongs to
       --redirect-uris REDIRECT_URIS
-			    The redirect URIs, this must be a space separated string e.g 'URI1 URI2'
+                            The redirect URIs, this must be a space separated string e.g 'URI1 URI2'
       --client-secret CLIENT_SECRET
-			    The secret for this application
+                            The secret for this application
       --name NAME           The name this application
       --skip-authorization  The ID of the new application
       ...
diff --git a/docs/oidc.rst b/docs/oidc.rst
index f4fdfd09c..4b427ba86 100644
--- a/docs/oidc.rst
+++ b/docs/oidc.rst
@@ -249,38 +249,39 @@ our custom validator. It takes one of two forms:
 
 The first form gets passed a request object, and should return a dictionary
 mapping a claim name to claim data::
+
     class CustomOAuth2Validator(OAuth2Validator):
-	# Set `oidc_claim_scope = None` to ignore scopes that limit which claims to return,
-	# otherwise the OIDC standard scopes are used.
+        # Set `oidc_claim_scope = None` to ignore scopes that limit which claims to return,
+        # otherwise the OIDC standard scopes are used.
 
         def get_additional_claims(self, request):
-	    return {
-		"given_name": request.user.first_name,
-		"family_name": request.user.last_name,
-		"name": ' '.join([request.user.first_name, request.user.last_name]),
-		"preferred_username": request.user.username,
-		"email": request.user.email,
-	    }
+            return {
+                "given_name": request.user.first_name,
+                "family_name": request.user.last_name,
+                "name": ' '.join([request.user.first_name, request.user.last_name]),
+                "preferred_username": request.user.username,
+                "email": request.user.email,
+            }
 
 
 The second form gets no request object, and should return a dictionary
 mapping a claim name to a callable, accepting a request and producing
 the claim data::
     class CustomOAuth2Validator(OAuth2Validator):
-	# Extend the standard scopes to add a new "permissions" scope
-	# which returns a "permissions" claim:
-	oidc_claim_scope = OAuth2Validator.oidc_claim_scope
-	oidc_claim_scope.update({"permissions": "permissions"})
-
-	def get_additional_claims(self):
-	    return {
-		"given_name": lambda request: request.user.first_name,
-		"family_name": lambda request: request.user.last_name,
-		"name": lambda request: ' '.join([request.user.first_name, request.user.last_name]),
-		"preferred_username": lambda request: request.user.username,
-		"email": lambda request: request.user.email,
-		"permissions": lambda request: list(request.user.get_group_permissions()),
-	    }
+        # Extend the standard scopes to add a new "permissions" scope
+        # which returns a "permissions" claim:
+        oidc_claim_scope = OAuth2Validator.oidc_claim_scope
+        oidc_claim_scope.update({"permissions": "permissions"})
+
+        def get_additional_claims(self):
+            return {
+                "given_name": lambda request: request.user.first_name,
+                "family_name": lambda request: request.user.last_name,
+                "name": lambda request: ' '.join([request.user.first_name, request.user.last_name]),
+                "preferred_username": lambda request: request.user.username,
+                "email": lambda request: request.user.email,
+                "permissions": lambda request: list(request.user.get_group_permissions()),
+            }
 
 
 Standard claim ``sub`` is included by default, to remove it override ``get_claim_dict``.
diff --git a/docs/rest-framework/permissions.rst b/docs/rest-framework/permissions.rst
index 1058aed3f..ee398d9fc 100644
--- a/docs/rest-framework/permissions.rst
+++ b/docs/rest-framework/permissions.rst
@@ -114,4 +114,4 @@ The following is a minimal OAS declaration that shows the same required alternat
 to try it in the `swagger editor <https://editor.swagger.io>`_.
 
 .. literalinclude:: openapi.yaml
-  :language: YAML
\ No newline at end of file
+  :language: YAML
diff --git a/docs/templates.rst b/docs/templates.rst
index 4f6320bf7..8ebcd4127 100644
--- a/docs/templates.rst
+++ b/docs/templates.rst
@@ -242,4 +242,4 @@ This template gets passed the following template context variable:
 
 .. important::
     To override successfully this template you should provide a form that posts to the same URL, example:
-    ``<form method="post" action="">``
\ No newline at end of file
+    ``<form method="post" action="">``
diff --git a/docs/tutorial/tutorial_05.rst b/docs/tutorial/tutorial_05.rst
index 784d489a8..1be656b88 100644
--- a/docs/tutorial/tutorial_05.rst
+++ b/docs/tutorial/tutorial_05.rst
@@ -83,9 +83,9 @@ We'll add ours now in ``tutorial/tasks.py``:
 
     @shared_task
     def clear_tokens():
-	from oauth2_provider.models import clear_expired
+        from oauth2_provider.models import clear_expired
 
-	clear_expired()
+        clear_expired()
 
 Finally, update ``tutorial/__init__.py`` to make sure Celery gets loaded when the app starts up:
 
diff --git a/docs/views/mixins.rst b/docs/views/mixins.rst
index be3541a88..a8da12414 100644
--- a/docs/views/mixins.rst
+++ b/docs/views/mixins.rst
@@ -2,4 +2,4 @@ Mixins for Class Based Views
 ============================
 
 .. automodule:: oauth2_provider.views.mixins
-   :members:
\ No newline at end of file
+   :members:
diff --git a/tox.ini b/tox.ini
index 7232ecef7..117a5e901 100644
--- a/tox.ini
+++ b/tox.ini
@@ -3,6 +3,7 @@ envlist =
     flake8,
     migrations,
     docs,
+    sphinxlint,
     py{37,38,39}-dj22,
     py{37,38,39,310}-dj32,
     py{38,39,310}-dj40,
@@ -11,7 +12,7 @@ envlist =
 [gh-actions]
 python =
     3.7: py37
-    3.8: py38, docs, flake8, migrations
+    3.8: py38, docs, flake8, migrations, sphinxlint
     3.9: py39
     3.10: py310
 
@@ -56,6 +57,12 @@ passenv =
 ignore_errors = true
 ignore_outcome = true
 
+[testenv:sphinxlint]
+deps = sphinx-lint
+skip_install = True
+commands =
+    sphinx-lint docs/
+
 [testenv:{docs,livedocs}]
 basepython = python3.8
 changedir = docs

From ec34fe935c3d2f0710e3d000b6f531efef4080ca Mon Sep 17 00:00:00 2001
From: Alan Crosswell <alan@columbia.edu>
Date: Sun, 24 Apr 2022 13:01:43 -0400
Subject: [PATCH 18/20] Corrections to glossary terms and documentation links.
 (#1136)

---
 docs/resource_server.rst | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/docs/resource_server.rst b/docs/resource_server.rst
index e19e542a8..4e623b118 100644
--- a/docs/resource_server.rst
+++ b/docs/resource_server.rst
@@ -1,6 +1,6 @@
 Separate Resource Server
 ========================
-Django OAuth Toolkit allows to separate the :term:`Authentication Server` and the :term:`Resource Server.`
+Django OAuth Toolkit allows to separate the :term:`Authorization Server` and the :term:`Resource Server`.
 Based on the `RFC 7662 <https://tools.ietf.org/html/rfc7662>`_ Django OAuth Toolkit provides
 a rfc-compliant introspection endpoint.
 As well the Django OAuth Toolkit allows to verify access tokens by the use of an introspection endpoint.
@@ -8,7 +8,7 @@ As well the Django OAuth Toolkit allows to verify access tokens by the use of an
 
 Setup the Authentication Server
 -------------------------------
-Setup the :term:`Authentication Server` as described in the :ref:`tutorial`.
+Setup the :term:`Authorization Server` as described in the :doc:`tutorial/tutorial`.
 Create a OAuth2 access token for the :term:`Resource Server` and add the
 ``introspection``-Scope to the settings.
 
@@ -21,7 +21,7 @@ Create a OAuth2 access token for the :term:`Resource Server` and add the
         ...
     },
 
-The :term:`Authentication Server` will listen for introspection requests.
+The :term:`Authorization Server` will listen for introspection requests.
 The endpoint is located within the ``oauth2_provider.urls`` as ``/introspect/``.
 
 Example Request::
@@ -49,10 +49,10 @@ Example Response::
 
 Setup the Resource Server
 -------------------------
-Setup the :term:`Resource Server` like the :term:`Authentication Server` as described in the :ref:`tutorial`.
+Setup the :term:`Resource Server` like the :term:`Authorization Server` as described in the :doc:`tutorial/tutorial`.
 Add ``RESOURCE_SERVER_INTROSPECTION_URL`` and **either** ``RESOURCE_SERVER_AUTH_TOKEN``
 **or** ``RESOURCE_SERVER_INTROSPECTION_CREDENTIALS`` as a ``(id,secret)`` tuple to your settings.
-The :term:`Resource Server` will try to verify its requests on the :term:`Authentication Server`.
+The :term:`Resource Server` will try to verify its requests on the :term:`Authorization Server`.
 
 .. code-block:: python
 
@@ -66,7 +66,7 @@ The :term:`Resource Server` will try to verify its requests on the :term:`Authen
 
 ``RESOURCE_SERVER_INTROSPECTION_URL`` defines the introspection endpoint and
 ``RESOURCE_SERVER_AUTH_TOKEN`` an authentication token to authenticate against the
-:term:`Authentication Server`.
+:term:`Authorization Server`.
 As allowed by RFC 7662, some external OAuth 2.0 servers support HTTP Basic Authentication.
 For these, use:
 ``RESOURCE_SERVER_INTROSPECTION_CREDENTIALS=('client_id','client_secret')`` instead

From e8d0ee6868021463a7d582495c2e7213eb59f67f Mon Sep 17 00:00:00 2001
From: Alan Crosswell <alan@crosswell.us>
Date: Sun, 24 Apr 2022 14:01:46 -0400
Subject: [PATCH 19/20] Add help wanted to the README (#1144)

* Add help wanted to the README

* Apply suggestions from code review

Co-authored-by: Andrew Chen Wang <60190294+Andrew-Chen-Wang@users.noreply.github.com>

Co-authored-by: Andrew Chen Wang <60190294+Andrew-Chen-Wang@users.noreply.github.com>
---
 README.rst | 52 +++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 47 insertions(+), 5 deletions(-)

diff --git a/README.rst b/README.rst
index 8a9f333db..3acf459d8 100644
--- a/README.rst
+++ b/README.rst
@@ -39,11 +39,6 @@ Note: If you have issues installing Django 4.0.0, it is because we only support
 Django 4.0.1+ due to a regression in Django 4.0.0. Besides 4.0.0, Django 2.2+ is supported.
 `Explanation <https://github.com/jazzband/django-oauth-toolkit/pull/1046#issuecomment-998015272>`_.
 
-Contributing
-------------
-
-We love contributions, so please feel free to fix bugs, improve things, provide documentation. Just `follow the
-guidelines <https://django-oauth-toolkit.readthedocs.io/en/latest/contributing.html>`_ and submit a PR.
 
 Reporting security issues
 -------------------------
@@ -99,3 +94,50 @@ License
 -------
 
 django-oauth-toolkit is released under the terms of the **BSD license**. Full details in ``LICENSE`` file.
+
+Help Wanted
+-----------
+
+We need help maintaining and enhancing django-oauth-toolkit (DOT).
+
+Join the team
+~~~~~~~~~~~~~
+
+Please consider joining `Jazzband <https://jazzband.co>`__ (If not
+already a member) and the `DOT project
+team <https://jazzband.co/projects/django-oauth-toolkit>`__.
+
+How you can help
+~~~~~~~~~~~~~~~~
+
+See our
+`contributing <https://django-oauth-toolkit.readthedocs.io/en/latest/contributing.html>`__
+info and the open
+`issues <https://github.com/jazzband/django-oauth-toolkit/issues>`__ and
+`PRs <https://github.com/jazzband/django-oauth-toolkit/pulls>`__,
+especially those labeled
+`help-wanted <https://github.com/jazzband/django-oauth-toolkit/labels/help-wanted>`__.
+
+Submit PRs and Perform Reviews
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+PR submissions and reviews are always appreciated! Since we require an
+independent review of any PR before it can be merged, having your second
+set of eyes looking at PRs is extremely valuable.
+
+Please don’t merge PRs
+~~~~~~~~~~~~~~~~~~~~~~
+
+Please be aware that we don’t want *every* Jazzband member to merge PRs
+but just a handful of project team members so that we can maintain a
+modicum of control over what goes into a release of this security oriented code base. Only `project
+leads <https://jazzband.co/projects/django-oauth-toolkit>`__ are able to
+publish releases to Pypi and it becomes difficult when creating a new
+release for the leads to deal with “unexpected” merged PRs.
+
+Become a Project Lead
+~~~~~~~~~~~~~~~~~~~~~
+
+If you are interested in stepping up to be a Project Lead, please join
+the
+`discussion <https://github.com/orgs/jazzband/teams/django-oauth-toolkit>`__.

From 025cd1b7d901150cdb671194970273081de34bc7 Mon Sep 17 00:00:00 2001
From: Alan Crosswell <alan@columbia.edu>
Date: Sun, 24 Apr 2022 14:26:59 -0400
Subject: [PATCH 20/20] Release 2.0.0 (#1145)

---
 CHANGELOG.md                | 9 +++++----
 oauth2_provider/__init__.py | 2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index baae70de8..7819fe616 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -16,7 +16,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [unreleased]
 
-## [2.0.0] unreleased
+## [2.0.0] 2022-04-24
+
+This is a major release with **BREAKING** changes. Please make sure to review these changes before upgrading:
 
 ### Added
 * #1106 OIDC: Add "scopes_supported" to the [ConnectDiscoveryInfoView](https://django-oauth-toolkit.readthedocs.io/en/latest/oidc.html#connectdiscoveryinfoview).
@@ -28,8 +30,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * #1129 (**Breaking**) Changed default value of PKCE_REQUIRED to True. This is a **breaking change**. Clients without
   PKCE enabled will fail to authenticate. This breaks with [section 5 of RFC7636](https://datatracker.ietf.org/doc/html/rfc7636)
   in favor of the [OAuth2 Security Best Practices for Authorization Code Grants](https://datatracker.ietf.org/doc/html/draft-ietf-oauth-security-topics#section-2.1).
-  If you want to retain the pre-2.x behavior, set `PKCE_REQUIRED = False ` in your settings.py
-
+  If you want to retain the pre-2.x behavior, set `PKCE_REQUIRED = False` in your settings.py
 * #1093 (**Breaking**) Changed to implement [hashed](https://docs.djangoproject.com/en/stable/topics/auth/passwords/)
   client_secret values. This is a **breaking change** that will migrate all your existing
   cleartext `application.client_secret` values to be hashed with Django's default password hashing algorithm
@@ -43,7 +44,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Fixed
 * #1108 OIDC: Fix `validate_bearer_token()` to properly set `request.scopes` to the list of granted scopes.
-* #1132: Fixed help text for `--skip-authorization` argument of the `createapplication` management command
+* #1132: Fixed help text for `--skip-authorization` argument of the `createapplication` management command.
 
 ### Removed
 * #1124 (**Breaking**, **Security**) Removes support for insecure `urn:ietf:wg:oauth:2.0:oob` and `urn:ietf:wg:oauth:2.0:oob:auto` which are replaced
diff --git a/oauth2_provider/__init__.py b/oauth2_provider/__init__.py
index 9024b6f63..49a4433da 100644
--- a/oauth2_provider/__init__.py
+++ b/oauth2_provider/__init__.py
@@ -1,7 +1,7 @@
 import django
 
 
-__version__ = "1.7.1"
+__version__ = "2.0.0"
 
 if django.VERSION < (3, 2):
     default_app_config = "oauth2_provider.apps.DOTConfig"