repoze.who is an identification and authentication framework
for arbitrary WSGI applications. repoze.who can be configured
either as WSGI middleware or as an API for use by an application.
repoze.who is inspired by Zope 2's Pluggable Authentication
Service (PAS) (but repoze.who is not dependent on Zope in any
way; it is useful for any WSGI application). It provides no facility
for authorization (ensuring whether a user can or cannot perform the
operation implied by the request). This is considered to be the
domain of the WSGI application.