Restricting edits to authenticated users

[aaronpk]

While I realize adding an authentication mechanism to Calagator is out of scope, what about delegating that to external systems and just checking the presence of the REMOTE_USER environment variable?

I'm working on updating some IndieWeb community infrastructure, and just did a similar thing for MediaWiki. Instead of updating our authentication extension, I just installed the Auth remoteuser extension which assumes if the REMOTE_USER environment variable is set then the user is logged in. Separately, I run a subdomain that actually handles logging users in, and it sets a cookie across *.indieweb.org.

I'd like to be able to deploy calagator at events.indieweb.org so it would also have access to this cookie. As such, Calagator can know if a user is already logged in, and use that to check whether they're allowed to create events.