Identity patterns and anti-patterns in real world web services