Merge branch 'feature.security-apis-on-request'

27 files changed, 655 insertions, 432 deletions

diff --git a/CHANGES.txt b/CHANGES.txt
index 895dc572f..9f780fe45 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -4,6 +4,25 @@ Unreleased
 Features
 --------
 
+- An authorization API has been added as a method of the
+  request: ``request.has_permission``.
+
+  ``request.has_permission`` is a method-based alternative to the
+  ``pyramid.security.has_permission`` API and works exactly the same.  The
+  older API is now deprecated.
+
+- Property API attributes have been added to the request for easier access to
+  authentication data: ``request.authenticated_userid``,
+  ``request.unauthenticated_userid``, and ``request.effective_principals``.
+
+  These are analogues, respectively, of
+  ``pyramid.security.authenticated_userid``,
+  ``pyramid.security.unauthenticated_userid``, and
+  ``pyramid.security.effective_principals``.  They operate exactly the same,
+  except they are attributes of the request instead of functions accepting a
+  request.  They are properties, so they cannot be assigned to.  The older
+  function-based APIs are now deprecated.
+
 - Pyramid's console scripts (``pserve``, ``pviews``, etc) can now be run
   directly, allowing custom arguments to be sent to the python interpreter
   at runtime. For example::
@@ -97,6 +116,27 @@ Deprecations
   the SignedCookieSessionFactory are not. See 
   https://github.com/Pylons/pyramid/pull/1142
 
+- The ``pyramid.security.has_permission`` API is now deprecated.  Instead, use
+  the newly-added ``has_permission`` method of the request object.
+
+- The ``pyramid.security.forget`` API is now deprecated.  Instead, use
+  the newly-added ``forget_userid`` method of the request object.
+
+- The ``pyramid.security.remember`` API is now deprecated.  Instead, use
+  the newly-added ``remember_userid`` method of the request object.
+
+- The ``pyramid.security.effective_principals`` API is now deprecated.
+  Instead, use the newly-added ``effective_principals`` attribute of the
+  request object.
+
+- The ``pyramid.security.authenticated_userid`` API is now deprecated.
+  Instead, use the newly-added ``authenticated_userid`` attribute of the
+  request object.
+
+- The ``pyramid.security.unauthenticated_userid`` API is now deprecated.
+  Instead, use the newly-added ``unauthenticated_userid`` attribute of the
+  request object.
+
 1.5a2 (2013-09-22)
 ==================
 
diff --git a/CONTRIBUTORS.txt b/CONTRIBUTORS.txt
index bfe22e540..6dba1076e 100644
--- a/CONTRIBUTORS.txt
+++ b/CONTRIBUTORS.txt
@@ -224,3 +224,5 @@ Contributors
 - Doug Hellmann, 2013/09/06
 
 - Karl O. Pinc, 2013/09/27
+
+- Matthew Russell, 2013/10/14
diff --git a/docs/api/request.rst b/docs/api/request.rst
index 72abddb68..b7604020e 100644
--- a/docs/api/request.rst
+++ b/docs/api/request.rst
@@ -11,7 +11,9 @@
    :exclude-members: add_response_callback, add_finished_callback,
                      route_url, route_path, current_route_url,
                      current_route_path, static_url, static_path,
-                     model_url, resource_url, set_property
+                     model_url, resource_url, set_property, 
+                     effective_principals, authenticated_userid,
+                     unauthenticated_userid, has_permission
 
    .. attribute:: context
 
@@ -161,6 +163,42 @@
       request, the value of this attribute will be ``None``. See
       :ref:`matched_route`.
 
+   .. attribute:: authenticated_userid
+
+      .. versionadded:: 1.5
+
+      A property which returns the userid of the currently authenticated user
+      or ``None`` if there is no :term:`authentication policy` in effect or
+      there is no currently authenticated user.  This differs from
+      :attr:`~pyramid.request.Request.unauthenticated_userid`, because the
+      effective authentication policy will have ensured that a record
+      associated with the userid exists in persistent storage; if it has
+      not, this value will be ``None``.
+
+   .. attribute:: unauthenticated_userid
+
+      .. versionadded:: 1.5
+
+      A property which returns a value which represents the *claimed* (not
+      verified) user id of the credentials present in the request. ``None`` if
+      there is no :term:`authentication policy` in effect or there is no user
+      data associated with the current request.  This differs from
+      :attr:`~pyramid.request.Request.authenticated_userid`, because the
+      effective authentication policy will not ensure that a record associated
+      with the userid exists in persistent storage.  Even if the userid
+      does not exist in persistent storage, this value will be the value
+      of the userid *claimed* by the request data.
+
+   .. attribute:: effective_principals
+
+      .. versionadded:: 1.5
+
+      A property which returns the list of 'effective' :term:`principal`
+      identifiers for this request.  This will include the userid of the
+      currently authenticated user if a user is currently authenticated. If no
+      :term:`authentication policy` is in effect, this will return a sequence
+      containing only the :attr:`pyramid.security.Everyone` principal.
+
    .. method:: invoke_subrequest(request, use_tweens=False)
 
       .. versionadded:: 1.4a1
@@ -215,6 +253,8 @@
       request provided by e.g. the ``pshell`` environment.  For more
       information, see :ref:`subrequest_chapter`.
 
+   .. automethod:: has_permission
+
    .. automethod:: add_response_callback
 
    .. automethod:: add_finished_callback
diff --git a/docs/narr/resources.rst b/docs/narr/resources.rst
index b1bb611e5..34d75f2cc 100644
--- a/docs/narr/resources.rst
+++ b/docs/narr/resources.rst
@@ -201,7 +201,7 @@ location-aware resources.  These APIs include (but are not limited to)
 :func:`~pyramid.traversal.resource_path`,
 :func:`~pyramid.traversal.resource_path_tuple`, or
 :func:`~pyramid.traversal.traverse`, :func:`~pyramid.traversal.virtual_root`,
-and (usually) :func:`~pyramid.security.has_permission` and
+and (usually) :meth:`~pyramid.request.Request.has_permission` and
 :func:`~pyramid.security.principals_allowed_by_permission`.
 
 In general, since so much :app:`Pyramid` infrastructure depends on
@@ -695,10 +695,10 @@ The APIs provided by :ref:`location_module` are used against resources.
 These can be used to walk down a resource tree, or conveniently locate one
 resource "inside" another.
 
-Some APIs in :ref:`security_module` accept a resource object as a parameter.
-For example, the :func:`~pyramid.security.has_permission` API accepts a
+Some APIs on the :class:`pyramid.request.Request` accept a resource object as a parameter.
+For example, the :meth:`~pyramid.request.Request.has_permission` API accepts a
 resource object as one of its arguments; the ACL is obtained from this
-resource or one of its ancestors.  Other APIs in the :mod:`pyramid.security`
-module also accept :term:`context` as an argument, and a context is always a
-resource.
+resource or one of its ancestors.  Other security related APIs on the 
+:class:`pyramid.request.Request` class also accept :term:`context` as an argument, 
+and a context is always a resource.
 
diff --git a/docs/narr/security.rst b/docs/narr/security.rst
index e85ed823a..9e6fb6c82 100644
--- a/docs/narr/security.rst
+++ b/docs/narr/security.rst
@@ -550,7 +550,7 @@ also contain security debugging information in its body.
 Debugging Imperative Authorization Failures
 -------------------------------------------
 
-The :func:`pyramid.security.has_permission` API is used to check
+The :meth:`pyramid.request.Request.has_permission` API is used to check
 security within view functions imperatively.  It returns instances of
 objects that are effectively booleans.  But these objects are not raw
 ``True`` or ``False`` objects, and have information attached to them
@@ -563,7 +563,7 @@ one of :data:`pyramid.security.ACLAllowed`,
 ``msg`` attribute, which is a string indicating why the permission was
 denied or allowed.  Introspecting this information in the debugger or
 via print statements when a call to
-:func:`~pyramid.security.has_permission` fails is often useful.
+:meth:`~pyramid.request.Request.has_permission` fails is often useful.
 
 .. index::
    single: authentication policy (creating)
diff --git a/docs/narr/testing.rst b/docs/narr/testing.rst
index 88d6904c7..5a5bf8fad 100644
--- a/docs/narr/testing.rst
+++ b/docs/narr/testing.rst
@@ -214,11 +214,10 @@ function.
 .. code-block:: python
    :linenos:
 
-   from pyramid.security import has_permission
    from pyramid.httpexceptions import HTTPForbidden
 
    def view_fn(request):
-       if not has_permission('edit', request.context, request):
+       if request.has_permission('edit'):
            raise HTTPForbidden
        return {'greeting':'hello'}
 
@@ -229,15 +228,16 @@ function.
    otherwise it would fail when run normally.
 
 Without doing anything special during a unit test, the call to
-:func:`~pyramid.security.has_permission` in this view function will always
-return a ``True`` value.  When a :app:`Pyramid` application starts normally,
-it will populate a :term:`application registry` using :term:`configuration
-declaration` calls made against a :term:`Configurator`.  But if this
-application registry is not created and populated (e.g. by initializing the
-configurator with an authorization policy), like when you invoke application
-code via a unit test, :app:`Pyramid` API functions will tend to either fail
-or return default results.  So how do you test the branch of the code in this
-view function that raises :exc:`~pyramid.httpexceptions.HTTPForbidden`?
+:meth:`~pyramid.request.Request.has_permission` in this view function will
+always return a ``True`` value.  When a :app:`Pyramid` application starts
+normally, it will populate a :term:`application registry` using
+:term:`configuration declaration` calls made against a :term:`Configurator`.
+But if this application registry is not created and populated (e.g. by
+initializing the configurator with an authorization policy), like when you
+invoke application code via a unit test, :app:`Pyramid` API functions will tend
+to either fail or return default results.  So how do you test the branch of the
+code in this view function that raises
+:exc:`~pyramid.httpexceptions.HTTPForbidden`?
 
 The testing API provided by :app:`Pyramid` allows you to simulate various
 application registry registrations for use under a unit testing framework
@@ -287,12 +287,12 @@ Its third line registers a "dummy" "non-permissive" authorization policy
 using the :meth:`~pyramid.config.Configurator.testing_securitypolicy` method,
 which is a special helper method for unit testing.
 
-We then create a :class:`pyramid.testing.DummyRequest` object which simulates
-a WebOb request object API.  A :class:`pyramid.testing.DummyRequest` is a
-request object that requires less setup than a "real" :app:`Pyramid` request.
-We call the function being tested with the manufactured request.  When the
-function is called, :func:`pyramid.security.has_permission` will call the
-"dummy" authentication policy we've registered through
+We then create a :class:`pyramid.testing.DummyRequest` object which simulates a
+WebOb request object API.  A :class:`pyramid.testing.DummyRequest` is a request
+object that requires less setup than a "real" :app:`Pyramid` request.  We call
+the function being tested with the manufactured request.  When the function is
+called, :meth:`pyramid.request.Request.has_permission` will call the "dummy"
+authentication policy we've registered through
 :meth:`~pyramid.config.Configurator.testing_securitypolicy`, which denies
 access.  We check that the view function raises a
 :exc:`~pyramid.httpexceptions.HTTPForbidden` error.
diff --git a/docs/narr/threadlocals.rst b/docs/narr/threadlocals.rst
index a90ee4905..afe56de3e 100644
--- a/docs/narr/threadlocals.rst
+++ b/docs/narr/threadlocals.rst
@@ -29,17 +29,16 @@ of a thread local or a global is usually just a way to avoid passing
 some value around between functions, which is itself usually a very
 bad idea, at least if code readability counts as an important concern.
 
-For historical reasons, however, thread local variables are indeed
-consulted by various :app:`Pyramid` API functions.  For example,
-the implementation of the :mod:`pyramid.security` function named
-:func:`~pyramid.security.authenticated_userid` retrieves the thread
-local :term:`application registry` as a matter of course to find an
+For historical reasons, however, thread local variables are indeed consulted by
+various :app:`Pyramid` API functions.  For example, the implementation of the
+:mod:`pyramid.security` function named
+:func:`~pyramid.security.authenticated_userid` (deprecated as of 1.5) retrieves
+the thread local :term:`application registry` as a matter of course to find an
 :term:`authentication policy`.  It uses the
-:func:`pyramid.threadlocal.get_current_registry` function to
-retrieve the application registry, from which it looks up the
-authentication policy; it then uses the authentication policy to
-retrieve the authenticated user id.  This is how :app:`Pyramid`
-allows arbitrary authentication policies to be "plugged in".
+:func:`pyramid.threadlocal.get_current_registry` function to retrieve the
+application registry, from which it looks up the authentication policy; it then
+uses the authentication policy to retrieve the authenticated user id.  This is
+how :app:`Pyramid` allows arbitrary authentication policies to be "plugged in".
 
 When they need to do so, :app:`Pyramid` internals use two API
 functions to retrieve the :term:`request` and :term:`application
diff --git a/docs/narr/viewconfig.rst b/docs/narr/viewconfig.rst
index 7c76116f7..e5a2c1ade 100644
--- a/docs/narr/viewconfig.rst
+++ b/docs/narr/viewconfig.rst
@@ -435,7 +435,7 @@ configured view.
 
   If specified, this value should be a :term:`principal` identifier or a
   sequence of principal identifiers.  If the
-  :func:`pyramid.security.effective_principals` method indicates that every
+  :meth:`pyramid.request.Request.effective_principals` method indicates that every
   principal named in the argument list is present in the current request, this
   predicate will return True; otherwise it will return False.  For example:
   ``effective_principals=pyramid.security.Authenticated`` or
diff --git a/docs/quick_tutorial/authentication/tutorial/views.py b/docs/quick_tutorial/authentication/tutorial/views.py
index 3038b6d9b..ab46eb2dd 100644
--- a/docs/quick_tutorial/authentication/tutorial/views.py
+++ b/docs/quick_tutorial/authentication/tutorial/views.py
@@ -2,8 +2,8 @@ from pyramid.httpexceptions import HTTPFound
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid
     )
+
 from pyramid.view import (
     view_config,
     view_defaults
@@ -16,7 +16,7 @@ from .security import USERS
 class TutorialViews:
     def __init__(self, request):
         self.request = request
-        self.logged_in = authenticated_userid(request)
+        self.logged_in = request.authenticated_userid
 
     @view_config(route_name='home')
     def home(self):
diff --git a/docs/quick_tutorial/authorization/tutorial/views.py b/docs/quick_tutorial/authorization/tutorial/views.py
index 92c1946ba..43d14455a 100644
--- a/docs/quick_tutorial/authorization/tutorial/views.py
+++ b/docs/quick_tutorial/authorization/tutorial/views.py
@@ -2,8 +2,8 @@ from pyramid.httpexceptions import HTTPFound
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid
     )
+
 from pyramid.view import (
     view_config,
     view_defaults,
@@ -17,7 +17,7 @@ from .security import USERS
 class TutorialViews:
     def __init__(self, request):
         self.request = request
-        self.logged_in = authenticated_userid(request)
+        self.logged_in = request.authenticated_userid
 
     @view_config(route_name='home')
     def home(self):
diff --git a/docs/tutorials/wiki/authorization.rst b/docs/tutorials/wiki/authorization.rst
index 460a852e0..62b1164e3 100644
--- a/docs/tutorials/wiki/authorization.rst
+++ b/docs/tutorials/wiki/authorization.rst
@@ -56,10 +56,10 @@ returns one of these values:
   return ``None``.
 
 For example, ``groupfinder('editor', request )`` returns ``['group:editor']``,
-``groupfinder('viewer', request)`` returns ``[]``, and ``groupfinder('admin', request)``
-returns ``None``.  We will use ``groupfinder()`` as an :term:`authentication policy`
-"callback" that will provide the :term:`principal` or principals
-for a user.
+``groupfinder('viewer', request)`` returns ``[]``, and ``groupfinder('admin',
+request)`` returns ``None``.  We will use ``groupfinder()`` as an
+:term:`authentication policy` "callback" that will provide the
+:term:`principal` or principals for a user.
 
 In a production system, user and group
 data will most often come from a database, but here we use "dummy"
@@ -251,18 +251,6 @@ in ``views.py``.
 Return a logged_in flag to the renderer
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Add the following line to the import at the head of
-``tutorial/tutorial/views.py``:
-
-.. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 11-15
-   :linenos:
-   :emphasize-lines: 4
-   :language: python
-
-(Only the highlighted line and a trailing comma on the preceding
-line need to be added.)
-
 Add a  ``logged_in`` parameter to the return value of
 ``view_page()``, ``edit_page()`` and  ``add_page()``,
 like this:
@@ -274,14 +262,13 @@ like this:
    return dict(page = page,
                content = content,
                edit_url = edit_url,
-               logged_in = authenticated_userid(request))
+               logged_in = request.authenticated_userid)
 
 (Only the highlighted line and a trailing comma on the preceding
 line need to be added.)
 
-:meth:`~pyramid.security.authenticated_userid()` will return ``None``
-if the user is not authenticated, or a user id if the user is
-authenticated.
+The :meth:`pyramid.request.Request.authenticated_userid` will be ``None`` if
+the user is not authenticated, or a user id if the user is authenticated.
 
 Add a "Logout" link when logged in
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/docs/tutorials/wiki/src/authorization/tutorial/views.py b/docs/tutorials/wiki/src/authorization/tutorial/views.py
index 77956b1e3..62e96e0e7 100644
--- a/docs/tutorials/wiki/src/authorization/tutorial/views.py
+++ b/docs/tutorials/wiki/src/authorization/tutorial/views.py
@@ -11,9 +11,9 @@ from pyramid.view import (
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid,
     )
 
+
 from .security import USERS
 from .models import Page
 
@@ -45,7 +45,7 @@ def view_page(context, request):
     edit_url = request.resource_url(context, 'edit_page')
 
     return dict(page = context, content = content, edit_url = edit_url,
-                logged_in = authenticated_userid(request))
+                logged_in = request.authenticated_userid)
 
 @view_config(name='add_page', context='.models.Wiki',
              renderer='templates/edit.pt',
@@ -65,7 +65,7 @@ def add_page(context, request):
     page.__parent__ = context
 
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(name='edit_page', context='.models.Page',
              renderer='templates/edit.pt',
@@ -77,7 +77,7 @@ def edit_page(context, request):
 
     return dict(page=context,
                 save_url=request.resource_url(context, 'edit_page'),
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(context='.models.Wiki', name='login',
              renderer='templates/login.pt')
diff --git a/docs/tutorials/wiki/src/tests/tutorial/views.py b/docs/tutorials/wiki/src/tests/tutorial/views.py
index 77956b1e3..62e96e0e7 100644
--- a/docs/tutorials/wiki/src/tests/tutorial/views.py
+++ b/docs/tutorials/wiki/src/tests/tutorial/views.py
@@ -11,9 +11,9 @@ from pyramid.view import (
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid,
     )
 
+
 from .security import USERS
 from .models import Page
 
@@ -45,7 +45,7 @@ def view_page(context, request):
     edit_url = request.resource_url(context, 'edit_page')
 
     return dict(page = context, content = content, edit_url = edit_url,
-                logged_in = authenticated_userid(request))
+                logged_in = request.authenticated_userid)
 
 @view_config(name='add_page', context='.models.Wiki',
              renderer='templates/edit.pt',
@@ -65,7 +65,7 @@ def add_page(context, request):
     page.__parent__ = context
 
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(name='edit_page', context='.models.Page',
              renderer='templates/edit.pt',
@@ -77,7 +77,7 @@ def edit_page(context, request):
 
     return dict(page=context,
                 save_url=request.resource_url(context, 'edit_page'),
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(context='.models.Wiki', name='login',
              renderer='templates/login.pt')
diff --git a/docs/tutorials/wiki2/authorization.rst b/docs/tutorials/wiki2/authorization.rst
index cf20db6d7..1e5d0dcbf 100644
--- a/docs/tutorials/wiki2/authorization.rst
+++ b/docs/tutorials/wiki2/authorization.rst
@@ -221,7 +221,7 @@ Add the following import statements to the
 head of ``tutorial/tutorial/views.py``:
 
 .. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 9-16,18,24-25
+   :lines: 9-19
    :linenos:
    :emphasize-lines: 3,6-9,11
    :language: python
@@ -274,17 +274,6 @@ added to ``views.py``.
 Return a logged_in flag to the renderer
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Add the following line to the import at the head of
-``tutorial/tutorial/views.py``:
-
-.. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 14-18
-   :linenos:
-   :emphasize-lines: 4
-   :language: python
-
-(Only the highlighted line needs to be added.)
-
 Add a  ``logged_in`` parameter to the return value of
 ``view_page()``, ``edit_page()`` and  ``add_page()``,
 like this:
@@ -296,12 +285,12 @@ like this:
    return dict(page = page,
                content = content,
                edit_url = edit_url,
-               logged_in = authenticated_userid(request))
+               logged_in = request.authenticated_userid)
 
 (Only the highlighted line needs to be added.)
 
-The :meth:`~pyramid.security.authenticated_userid` method will return None
-if the user is not authenticated.
+The :meth:`~pyramid.request.Request.authenticated_userid` property will be
+``None`` if the user is not authenticated.
 
 Add a "Logout" link when logged in
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -349,7 +338,7 @@ when we're done:
 
 .. literalinclude:: src/authorization/tutorial/views.py
    :linenos:
-   :emphasize-lines: 11,14-18,25,31,37,58,61,73,76,88,91-117,119-123
+   :emphasize-lines: 11,14-19,25,31,37,58,61,73,76,88,91-117,119-123
    :language: python
 
 (Only the highlighted lines need to be added.)
diff --git a/docs/tutorials/wiki2/src/authorization/tutorial/views.py b/docs/tutorials/wiki2/src/authorization/tutorial/views.py
index b6dbbf5f6..e954d5a31 100644
--- a/docs/tutorials/wiki2/src/authorization/tutorial/views.py
+++ b/docs/tutorials/wiki2/src/authorization/tutorial/views.py
@@ -14,15 +14,15 @@ from pyramid.view import (
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid,
     )
 
+from .security import USERS
+
 from .models import (
     DBSession,
     Page,
     )
 
-from .security import USERS
 
 # regular expression used to find WikiWords
 wikiwords = re.compile(r"\b([A-Z]\w+[A-Z]+\w+)")
@@ -55,7 +55,7 @@ def view_page(request):
     content = wikiwords.sub(check, content)
     edit_url = request.route_url('edit_page', pagename=pagename)
     return dict(page=page, content=content, edit_url=edit_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='add_page', renderer='templates/edit.pt',
              permission='edit')
@@ -70,7 +70,7 @@ def add_page(request):
     save_url = request.route_url('add_page', pagename=pagename)
     page = Page(name='', data='')
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='edit_page', renderer='templates/edit.pt',
              permission='edit')
@@ -84,8 +84,8 @@ def edit_page(request):
                                                       pagename=pagename))
     return dict(
         page=page,
-        save_url = request.route_url('edit_page', pagename=pagename),
-        logged_in=authenticated_userid(request),
+        save_url=request.route_url('edit_page', pagename=pagename),
+        logged_in=request.authenticated_userid
         )
 
 @view_config(route_name='login', renderer='templates/login.pt')
diff --git a/docs/tutorials/wiki2/src/tests/tutorial/tests.py b/docs/tutorials/wiki2/src/tests/tutorial/tests.py
index 4ee30685e..c50e05b6d 100644
--- a/docs/tutorials/wiki2/src/tests/tutorial/tests.py
+++ b/docs/tutorials/wiki2/src/tests/tutorial/tests.py
@@ -26,27 +26,6 @@ def _registerRoutes(config):
     config.add_route('add_page', 'add_page/{pagename}')
 
 
-class PageModelTests(unittest.TestCase):
-
-    def setUp(self):
-        self.session = _initTestingDB()
-
-    def tearDown(self):
-        self.session.remove()
-
-    def _getTargetClass(self):
-        from tutorial.models import Page
-        return Page
-
-    def _makeOne(self, name='SomeName', data='some data'):
-        return self._getTargetClass()(name, data)
-
-    def test_constructor(self):
-        instance = self._makeOne()
-        self.assertEqual(instance.name, 'SomeName')
-        self.assertEqual(instance.data, 'some data')
-
-
 class ViewWikiTests(unittest.TestCase):
     def setUp(self):
         self.config = testing.setUp()
diff --git a/docs/tutorials/wiki2/src/tests/tutorial/views.py b/docs/tutorials/wiki2/src/tests/tutorial/views.py
index b6dbbf5f6..41bea4785 100644
--- a/docs/tutorials/wiki2/src/tests/tutorial/views.py
+++ b/docs/tutorials/wiki2/src/tests/tutorial/views.py
@@ -14,15 +14,15 @@ from pyramid.view import (
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid,
     )
 
+from .security import USERS
+
 from .models import (
     DBSession,
     Page,
     )
 
-from .security import USERS
 
 # regular expression used to find WikiWords
 wikiwords = re.compile(r"\b([A-Z]\w+[A-Z]+\w+)")
@@ -55,7 +55,7 @@ def view_page(request):
     content = wikiwords.sub(check, content)
     edit_url = request.route_url('edit_page', pagename=pagename)
     return dict(page=page, content=content, edit_url=edit_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='add_page', renderer='templates/edit.pt',
              permission='edit')
@@ -70,7 +70,7 @@ def add_page(request):
     save_url = request.route_url('add_page', pagename=pagename)
     page = Page(name='', data='')
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='edit_page', renderer='templates/edit.pt',
              permission='edit')
@@ -84,8 +84,8 @@ def edit_page(request):
                                                       pagename=pagename))
     return dict(
         page=page,
-        save_url = request.route_url('edit_page', pagename=pagename),
-        logged_in=authenticated_userid(request),
+        save_url=request.route_url('edit_page', pagename=pagename),
+        logged_in=request.authenticated_userid
         )
 
 @view_config(route_name='login', renderer='templates/login.pt')
@@ -121,4 +121,3 @@ def logout(request):
     headers = forget(request)
     return HTTPFound(location = request.route_url('view_wiki'),
                      headers = headers)
-    
diff --git a/pyramid/config/predicates.py b/pyramid/config/predicates.py
index c8f66e83d..967f2eeee 100644
--- a/pyramid/config/predicates.py
+++ b/pyramid/config/predicates.py
@@ -13,7 +13,6 @@ from pyramid.traversal import (
 from pyramid.urldispatch import _compile_route
 from pyramid.util import object_description
 from pyramid.session import check_csrf_token
-from pyramid.security import effective_principals
 
 from .util import as_sorted_tuple
 
@@ -288,7 +287,7 @@ class EffectivePrincipalsPredicate(object):
     phash = text
 
     def __call__(self, context, request):
-        req_principals = effective_principals(request)
+        req_principals = request.effective_principals
         if is_nonstr_iter(req_principals):
             rpset = set(req_principals)
             if self.val.issubset(rpset):
diff --git a/pyramid/config/routes.py b/pyramid/config/routes.py
index 4de4663a8..4fd207600 100644
--- a/pyramid/config/routes.py
+++ b/pyramid/config/routes.py
@@ -237,10 +237,10 @@ class RoutesConfiguratorMixin(object):
 
           If specified, this value should be a :term:`principal` identifier or
           a sequence of principal identifiers.  If the
-          :func:`pyramid.security.effective_principals` method indicates that
-          every principal named in the argument list is present in the current
-          request, this predicate will return True; otherwise it will return
-          False.  For example:
+          :attr:`pyramid.request.Request.effective_principals` property
+          indicates that every principal named in the argument list is present
+          in the current request, this predicate will return True; otherwise it
+          will return False.  For example:
           ``effective_principals=pyramid.security.Authenticated`` or
           ``effective_principals=('fred', 'group:admins')``.
 
diff --git a/pyramid/config/testing.py b/pyramid/config/testing.py
index 2ab85b1f5..5df726a31 100644
--- a/pyramid/config/testing.py
+++ b/pyramid/config/testing.py
@@ -47,14 +47,14 @@ class TestingConfiguratorMixin(object):
         ``groupids`` argument.  The authentication policy will return
         the userid identifier implied by the ``userid`` argument and
         the group ids implied by the ``groupids`` argument when the
-        :func:`pyramid.security.authenticated_userid` or
-        :func:`pyramid.security.effective_principals` APIs are
+        :attr:`pyramid.request.Request.authenticated_userid` or
+        :attr:`pyramid.request.Request.effective_principals` APIs are
         used.
 
         This function is most useful when testing code that uses
-        the APIs named :func:`pyramid.security.has_permission`,
-        :func:`pyramid.security.authenticated_userid`,
-        :func:`pyramid.security.effective_principals`, and
+        the APIs named :meth:`pyramid.request.Request.has_permission`,
+        :attr:`pyramid.request.Request.authenticated_userid`,
+        :attr:`pyramid.request.Request.effective_principals`, and
         :func:`pyramid.security.principals_allowed_by_permission`.
 
         .. versionadded:: 1.4
diff --git a/pyramid/config/views.py b/pyramid/config/views.py
index 69f68e422..a3f885504 100644
--- a/pyramid/config/views.py
+++ b/pyramid/config/views.py
@@ -1017,10 +1017,10 @@ class ViewsConfiguratorMixin(object):
 
           If specified, this value should be a :term:`principal` identifier or
           a sequence of principal identifiers.  If the
-          :func:`pyramid.security.effective_principals` method indicates that
-          every principal named in the argument list is present in the current
-          request, this predicate will return True; otherwise it will return
-          False.  For example:
+          :attr:`pyramid.request.Request.effective_principals` property
+          indicates that every principal named in the argument list is present
+          in the current request, this predicate will return True; otherwise it
+          will return False.  For example:
           ``effective_principals=pyramid.security.Authenticated`` or
           ``effective_principals=('fred', 'group:admins')``.
 
diff --git a/pyramid/request.py b/pyramid/request.py
index 2cf0613f7..188e968ac 100644
--- a/pyramid/request.py
+++ b/pyramid/request.py
@@ -21,6 +21,10 @@ from pyramid.compat import (
 from pyramid.decorator import reify
 from pyramid.i18n import LocalizerRequestMixin
 from pyramid.response import Response
+from pyramid.security import (
+    AuthenticationAPIMixin,
+    AuthorizationAPIMixin,
+    )
 from pyramid.url import URLMethodsMixin
 from pyramid.util import InstancePropertyMixin
 
@@ -136,8 +140,15 @@ class CallbackMethodsMixin(object):
             callback(self)
 
 @implementer(IRequest)
-class Request(BaseRequest, URLMethodsMixin, CallbackMethodsMixin,
-              InstancePropertyMixin, LocalizerRequestMixin):
+class Request(
+    BaseRequest,
+    URLMethodsMixin,
+    CallbackMethodsMixin,
+    InstancePropertyMixin,
+    LocalizerRequestMixin,
+    AuthenticationAPIMixin,
+    AuthorizationAPIMixin,
+    ):
     """
     A subclass of the :term:`WebOb` Request class.  An instance of
     this class is created by the :term:`router` and is provided to a
diff --git a/pyramid/security.py b/pyramid/security.py
index 3e25f9b2f..58fa9332a 100644
--- a/pyramid/security.py
+++ b/pyramid/security.py
@@ -1,3 +1,4 @@
+from zope.deprecation import deprecated
 from zope.interface import providedBy
 
 from pyramid.interfaces import (
@@ -30,79 +31,143 @@ DENY_ALL = (Deny, Everyone, ALL_PERMISSIONS)
 
 NO_PERMISSION_REQUIRED = '__no_permission_required__'
 
-def has_permission(permission, context, request):
-    """ Provided a permission (a string or unicode object), a context
-    (a :term:`resource` instance) and a request object, return an
-    instance of :data:`pyramid.security.Allowed` if the permission
-    is granted in this context to the user implied by the
-    request. Return an instance of :mod:`pyramid.security.Denied`
-    if this permission is not granted in this context to this user.
-    This function delegates to the current authentication and
-    authorization policies.  Return
-    :data:`pyramid.security.Allowed` unconditionally if no
-    authentication policy has been configured in this application."""
+def _get_registry(request):
     try:
         reg = request.registry
     except AttributeError:
         reg = get_current_registry() # b/c
-    authn_policy = reg.queryUtility(IAuthenticationPolicy)
-    if authn_policy is None:
-        return Allowed('No authentication policy in use.')
+    return reg
 
-    authz_policy = reg.queryUtility(IAuthorizationPolicy)
-    if authz_policy is None:
-        raise ValueError('Authentication policy registered without '
-                         'authorization policy') # should never happen
-    principals = authn_policy.effective_principals(request)
-    return authz_policy.permits(context, principals, permission)
+def _get_authentication_policy(request):
+    registry = _get_registry(request)
+    return registry.queryUtility(IAuthenticationPolicy)
 
-def authenticated_userid(request):
-    """ Return the userid of the currently authenticated user or
-    ``None`` if there is no :term:`authentication policy` in effect or
-    there is no currently authenticated user."""
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
+def has_permission(permission, context, request):
+    """
+    A function that calls
+    :meth:`pyramid.request.Request.has_permission` and returns its result.
+    
+    .. deprecated:: 1.5
+       Use :meth:`pyramid.request.Request.has_permission` instead.
+
+    .. versionchanged:: 1.5a3
+       If context is None, then attempt to use the context attribute
+       of self, if not set then the  AttributeError is propergated.
+    """    
+    return request.has_permission(permission, context)
+
+deprecated(
+    'has_permission',
+    'As of Pyramid 1.5 the "pyramid.security.has_permission" API is now '
+    'deprecated.  It will be removed in Pyramd 1.8.  Use the '
+    '"has_permission" method of the Pyramid request instead.'
+    )
 
-    policy = reg.queryUtility(IAuthenticationPolicy)
-    if policy is None:
-        return None
-    return policy.authenticated_userid(request)
+
+def authenticated_userid(request):
+    """
+    A function that returns the value of the property
+    :attr:`pyramid.request.Request.authenticated_userid`.
+    
+    .. deprecated:: 1.5
+       Use :attr:`pyramid.request.Request.authenticated_userid` instead.
+    """        
+    return request.authenticated_userid
+
+deprecated(
+    'authenticated_userid',
+    'As of Pyramid 1.5 the "pyramid.security.authenticated_userid" API is now '
+    'deprecated.  It will be removed in Pyramd 1.8.  Use the '
+    '"authenticated_userid" attribute of the Pyramid request instead.'
+    )
 
 def unauthenticated_userid(request):
-    """ Return an object which represents the *claimed* (not verified) user
-    id of the credentials present in the request. ``None`` if there is no
-    :term:`authentication policy` in effect or there is no user data
-    associated with the current request.  This differs from
-    :func:`~pyramid.security.authenticated_userid`, because the effective
-    authentication policy will not ensure that a record associated with the
-    userid exists in persistent storage."""
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
+    """ 
+    A function that returns the value of the property
+    :attr:`pyramid.request.Request.unauthenticated_userid`.
+    
+    .. deprecated:: 1.5
+       Use :attr:`pyramid.request.Request.unauthenticated_userid` instead.
+    """        
+    return request.unauthenticated_userid
+
+deprecated(
+    'unauthenticated_userid',
+    'As of Pyramid 1.5 the "pyramid.security.unauthenticated_userid" API is '
+    'now deprecated.  It will be removed in Pyramd 1.8.  Use the '
+    '"unauthenticated_userid" attribute of the Pyramid request instead.'
+    )
+
+def effective_principals(request):
+    """
+    A function that returns the value of the property
+    :attr:`pyramid.request.Request.effective_principals`.
+    
+    .. deprecated:: 1.5
+       Use :attr:`pyramid.request.Request.effective_principals` instead.
+    """            
+    return request.effective_principals
+
+deprecated(
+    'effective_principals',
+    'As of Pyramid 1.5 the "pyramid.security.effective_principals" API is '
+    'now deprecated.  It will be removed in Pyramd 1.8.  Use the '
+    '"effective_principals" attribute of the Pyramid request instead.'
+    )
+
+def remember(request, principal, **kw):
+    """
+    Returns a sequence of header tuples (e.g. ``[('Set-Cookie', 'foo=abc')]``)
+    on this request's response.
+    These headers are suitable for 'remembering' a set of credentials
+    implied by the data passed as ``principal`` and ``*kw`` using the
+    current :term:`authentication policy`.  Common usage might look
+    like so within the body of a view function (``response`` is
+    assumed to be a :term:`WebOb` -style :term:`response` object
+    computed previously by the view code)::
 
-    policy = reg.queryUtility(IAuthenticationPolicy)
+    .. code-block:: python
+
+       from pyramid.security import remember
+       headers = remember(request, 'chrism', password='123', max_age='86400')
+       response = request.response
+       response.headerlist.extend(headers)
+       return response
+
+    If no :term:`authentication policy` is in use, this function will
+    always return an empty sequence. If used, the composition and
+    meaning of ``**kw`` must be agreed upon by the calling code and
+    the effective authentication policy.
+    """
+    policy = _get_authentication_policy(request)
     if policy is None:
-        return None
-    return policy.unauthenticated_userid(request)
+        return []
+    return policy.remember(request, principal, **kw)
 
-def effective_principals(request):
-    """ Return the list of 'effective' :term:`principal` identifiers
-    for the ``request``.  This will include the userid of the
-    currently authenticated user if a user is currently
-    authenticated. If no :term:`authentication policy` is in effect,
-    this will return an empty sequence."""
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
+def forget(request):
+    """
+    Return a sequence of header tuples (e.g. ``[('Set-Cookie',
+    'foo=abc')]``) suitable for 'forgetting' the set of credentials
+    possessed by the currently authenticated user.  A common usage
+    might look like so within the body of a view function
+    (``response`` is assumed to be an :term:`WebOb` -style
+    :term:`response` object computed previously by the view code)::
+
+      from pyramid.security import forget
+      headers = forget(request)
+      response.headerlist.extend(headers)
+      return response
 
-    policy = reg.queryUtility(IAuthenticationPolicy)
+    If no :term:`authentication policy` is in use, this function will
+    always return an empty sequence.
+
+    .. deprecated:: 1.5
+       Use :meth:`pyramid.request.Request.get_logout_headers` instead.
+    """            
+    policy = _get_authentication_policy(request)
     if policy is None:
-        return [Everyone]
-    return policy.effective_principals(request)
+        return []
+    return policy.forget(request)
 
 def principals_allowed_by_permission(context, permission):
     """ Provided a ``context`` (a resource object), and a ``permission``
@@ -140,10 +205,7 @@ def view_execution_permitted(context, request, name=''):
        An exception is raised if no view is found.
 
     """
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
+    reg = _get_registry(request)
     provides = [IViewClassifier] + map_(providedBy, (request, context))
     view = reg.adapters.lookup(provides, ISecuredView, name=name)
     if view is None:
@@ -157,58 +219,6 @@ def view_execution_permitted(context, request, name=''):
             (name, context))
     return view.__permitted__(context, request)
 
-def remember(request, principal, **kw):
-    """ Return a sequence of header tuples (e.g. ``[('Set-Cookie',
-    'foo=abc')]``) suitable for 'remembering' a set of credentials
-    implied by the data passed as ``principal`` and ``*kw`` using the
-    current :term:`authentication policy`.  Common usage might look
-    like so within the body of a view function (``response`` is
-    assumed to be a :term:`WebOb` -style :term:`response` object
-    computed previously by the view code)::
-
-      from pyramid.security import remember
-      headers = remember(request, 'chrism', password='123', max_age='86400')
-      response.headerlist.extend(headers)
-      return response
-
-    If no :term:`authentication policy` is in use, this function will
-    always return an empty sequence.  If used, the composition and
-    meaning of ``**kw`` must be agreed upon by the calling code and
-    the effective authentication policy."""
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
-    policy = reg.queryUtility(IAuthenticationPolicy)
-    if policy is None:
-        return []
-    else:
-        return policy.remember(request, principal, **kw)
-
-def forget(request):
-    """ Return a sequence of header tuples (e.g. ``[('Set-Cookie',
-    'foo=abc')]``) suitable for 'forgetting' the set of credentials
-    possessed by the currently authenticated user.  A common usage
-    might look like so within the body of a view function
-    (``response`` is assumed to be an :term:`WebOb` -style
-    :term:`response` object computed previously by the view code)::
-
-      from pyramid.security import forget
-      headers = forget(request)
-      response.headerlist.extend(headers)
-      return response
-
-    If no :term:`authentication policy` is in use, this function will
-    always return an empty sequence."""
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
-    policy = reg.queryUtility(IAuthenticationPolicy)
-    if policy is None:
-        return []
-    else:
-        return policy.forget(request)
 
 class PermitsResult(int):
     def __new__(cls, s, *args):
@@ -294,3 +304,89 @@ class ACLAllowed(ACLPermitsResult):
     summary is available as the ``msg`` attribute."""
     boolval = 1
 
+class AuthenticationAPIMixin(object):
+
+    def _get_authentication_policy(self):
+        reg = _get_registry(self)
+        return reg.queryUtility(IAuthenticationPolicy)
+
+    @property
+    def authenticated_userid(self):
+        """ Return the userid of the currently authenticated user or
+        ``None`` if there is no :term:`authentication policy` in effect or
+        there is no currently authenticated user.
+
+        .. versionadded:: 1.5
+        """
+        policy = self._get_authentication_policy()
+        if policy is None:
+            return None
+        return policy.authenticated_userid(self)
+
+    @property
+    def unauthenticated_userid(self):
+        """ Return an object which represents the *claimed* (not verified) user
+        id of the credentials present in the request. ``None`` if there is no
+        :term:`authentication policy` in effect or there is no user data
+        associated with the current request.  This differs from
+        :attr:`~pyramid.request.Request.authenticated_userid`, because the
+        effective authentication policy will not ensure that a record
+        associated with the userid exists in persistent storage.
+
+        .. versionadded:: 1.5
+        """
+        policy = self._get_authentication_policy()
+        if policy is None:
+            return None
+        return policy.unauthenticated_userid(self)
+
+    @property
+    def effective_principals(self):
+        """ Return the list of 'effective' :term:`principal` identifiers
+        for the ``request``.  This will include the userid of the
+        currently authenticated user if a user is currently
+        authenticated. If no :term:`authentication policy` is in effect,
+        this will return an empty sequence.
+
+        .. versionadded:: 1.5
+        """
+        policy = self._get_authentication_policy()
+        if policy is None:
+            return [Everyone]
+        return policy.effective_principals(self)
+    
+class AuthorizationAPIMixin(object):
+
+    def has_permission(self, permission, context=None):
+        """ Given a permission and an optional context, returns an instance of
+        :data:`pyramid.security.Allowed` if the permission is granted to this
+        request with the provided context, or the context already associated
+        with the request.  Otherwise, returns an instance of
+        :data:`pyramid.security.Denied`.  This method delegates to the current
+        authentication and authorization policies.  Returns
+        :data:`pyramid.security.Allowed` unconditionally if no authentication
+        policy has been registered for this request.  If ``context`` is not
+        supplied or is supplied as ``None``, the context used is the
+        ``request.context`` attribute.
+
+        :param permission: Does this request have the given permission?
+        :type permission: unicode, str
+        :param context: A resource object or ``None``
+        :type context: object
+        :returns: `pyramid.security.PermitsResult`
+
+        .. versionadded:: 1.5
+
+        """
+        if context is None:
+            context = self.context
+        reg = _get_registry(self)
+        authn_policy = reg.queryUtility(IAuthenticationPolicy)
+        if authn_policy is None:
+            return Allowed('No authentication policy in use.')
+        authz_policy = reg.queryUtility(IAuthorizationPolicy)
+        if authz_policy is None:
+            raise ValueError('Authentication policy registered without '
+                             'authorization policy') # should never happen
+        principals = authn_policy.effective_principals(self)
+        return authz_policy.permits(context, principals, permission)
diff --git a/pyramid/testing.py b/pyramid/testing.py
index 4590c55f8..b3460d8aa 100644
--- a/pyramid/testing.py
+++ b/pyramid/testing.py
@@ -27,6 +27,8 @@ from pyramid.registry import Registry
 from pyramid.security import (
     Authenticated,
     Everyone,
+    AuthenticationAPIMixin,
+    AuthorizationAPIMixin,
     )
 
 from pyramid.threadlocal import (
@@ -280,10 +282,15 @@ class DummySession(dict):
             token = self.new_csrf_token()
         return token
 
-        
 @implementer(IRequest)
-class DummyRequest(URLMethodsMixin, CallbackMethodsMixin, InstancePropertyMixin,
-                   LocalizerRequestMixin):
+class DummyRequest(
+    URLMethodsMixin,
+    CallbackMethodsMixin,
+    InstancePropertyMixin,
+    LocalizerRequestMixin,
+    AuthenticationAPIMixin,
+    AuthorizationAPIMixin,
+    ):
     """ A DummyRequest object (incompletely) imitates a :term:`request` object.
 
     The ``params``, ``environ``, ``headers``, ``path``, and
diff --git a/pyramid/tests/test_config/test_testing.py b/pyramid/tests/test_config/test_testing.py
index 1089f09fc..05561bfe9 100644
--- a/pyramid/tests/test_config/test_testing.py
+++ b/pyramid/tests/test_config/test_testing.py
@@ -1,6 +1,7 @@
 import unittest
 
 from pyramid.compat import text_
+from pyramid.security import AuthenticationAPIMixin, AuthorizationAPIMixin
 from pyramid.tests.test_config import IDummy
 
 class TestingConfiguratorMixinTests(unittest.TestCase):
@@ -196,13 +197,9 @@ from zope.interface import implementer
 class DummyEvent:
     pass
 
-class DummyRequest:
-    subpath = ()
-    matchdict = None
+class DummyRequest(AuthenticationAPIMixin, AuthorizationAPIMixin):
     def __init__(self, environ=None):
         if environ is None:
             environ = {}
         self.environ = environ
-        self.params = {}
-        self.cookies = {}
-
+        
diff --git a/pyramid/tests/test_request.py b/pyramid/tests/test_request.py
index 6cd72fc59..ed41b62ff 100644
--- a/pyramid/tests/test_request.py
+++ b/pyramid/tests/test_request.py
@@ -6,9 +6,10 @@ from pyramid.compat import (
     text_,
     bytes_,
     native_,
-    iteritems_,
-    iterkeys_,
-    itervalues_,
+    )
+from pyramid.security import (
+    AuthenticationAPIMixin,
+    AuthorizationAPIMixin,
     )
 
 class TestRequest(unittest.TestCase):
@@ -53,6 +54,11 @@ class TestRequest(unittest.TestCase):
         cls = self._getTargetClass()
         self.assertEqual(cls.ResponseClass, Response)
 
+    def test_implements_security_apis(self):
+        apis = (AuthenticationAPIMixin, AuthorizationAPIMixin)
+        r = self._makeOne()
+        self.assertTrue(isinstance(r, apis))
+
     def test_charset_defaults_to_utf8(self):
         r = self._makeOne({'PATH_INFO':'/'})
         self.assertEqual(r.charset, 'UTF-8')
diff --git a/pyramid/tests/test_security.py b/pyramid/tests/test_security.py
index e530e33ca..6f08a100c 100644
--- a/pyramid/tests/test_security.py
+++ b/pyramid/tests/test_security.py
@@ -1,14 +1,13 @@
 import unittest
 
-from pyramid.testing import cleanUp
-
+from pyramid import testing
 
 class TestAllPermissionsList(unittest.TestCase):
     def setUp(self):
-        cleanUp()
+        testing.setUp()
 
     def tearDown(self):
-        cleanUp()
+        testing.tearDown()
 
     def _getTargetClass(self):
         from pyramid.security import AllPermissionsList
@@ -103,13 +102,101 @@ class TestACLDenied(unittest.TestCase):
         self.assertTrue('<ACLDenied instance at ' in repr(denied))
         self.assertTrue("with msg %r>" % msg in repr(denied))
 
-class TestViewExecutionPermitted(unittest.TestCase):
+class TestPrincipalsAllowedByPermission(unittest.TestCase):
     def setUp(self):
-        cleanUp()
+        testing.setUp()
+
+    def tearDown(self):
+        testing.tearDown()
+
+    def _callFUT(self, *arg):
+        from pyramid.security import principals_allowed_by_permission
+        return principals_allowed_by_permission(*arg)
+
+    def test_no_authorization_policy(self):
+        from pyramid.security import Everyone
+        context = DummyContext()
+        result = self._callFUT(context, 'view')
+        self.assertEqual(result, [Everyone])
+
+    def test_with_authorization_policy(self):
+        from pyramid.threadlocal import get_current_registry
+        registry = get_current_registry()
+        _registerAuthorizationPolicy(registry, 'yo')
+        context = DummyContext()
+        result = self._callFUT(context, 'view')
+        self.assertEqual(result, 'yo')
+
+class TestRemember(unittest.TestCase):
+    def setUp(self):
+        testing.setUp()
+        
+    def tearDown(self):
+        testing.tearDown()
+
+    def _callFUT(self, *arg):
+        from pyramid.security import remember
+        return remember(*arg)
+
+    def test_no_authentication_policy(self):
+        request = _makeRequest()
+        result = self._callFUT(request, 'me')
+        self.assertEqual(result, [])
 
+    def test_with_authentication_policy(self):
+        request = _makeRequest()
+        registry = request.registry
+        _registerAuthenticationPolicy(registry, 'yo')
+        result = self._callFUT(request, 'me')
+        self.assertEqual(result, [('X-Pyramid-Test', 'me')])
+
+    def test_with_authentication_policy_no_reg_on_request(self):
+        from pyramid.threadlocal import get_current_registry
+        registry = get_current_registry()
+        request = _makeRequest()
+        del request.registry
+        _registerAuthenticationPolicy(registry, 'yo')
+        result = self._callFUT(request, 'me')
+        self.assertEqual(result, [('X-Pyramid-Test', 'me')])
+
+class TestForget(unittest.TestCase):
+    def setUp(self):
+        testing.setUp()
+        
     def tearDown(self):
-        cleanUp()
+        testing.tearDown()
 
+    def _callFUT(self, *arg):
+        from pyramid.security import forget
+        return forget(*arg)
+
+    def test_no_authentication_policy(self):
+        request = _makeRequest()
+        result = self._callFUT(request)
+        self.assertEqual(result, [])
+
+    def test_with_authentication_policy(self):
+        request = _makeRequest()
+        _registerAuthenticationPolicy(request.registry, 'yo')
+        result = self._callFUT(request)
+        self.assertEqual(result, [('X-Pyramid-Test', 'logout')])
+
+    def test_with_authentication_policy_no_reg_on_request(self):
+        from pyramid.threadlocal import get_current_registry
+        registry = get_current_registry()
+        request = _makeRequest()
+        del request.registry
+        _registerAuthenticationPolicy(registry, 'yo')
+        result = self._callFUT(request)
+        self.assertEqual(result, [('X-Pyramid-Test', 'logout')])
+        
+class TestViewExecutionPermitted(unittest.TestCase):
+    def setUp(self):
+        testing.setUp()
+
+    def tearDown(self):
+        testing.tearDown()
+    
     def _callFUT(self, *arg, **kw):
         from pyramid.security import view_execution_permitted
         return view_execution_permitted(*arg, **kw)
@@ -140,7 +227,7 @@ class TestViewExecutionPermitted(unittest.TestCase):
         reg = get_current_registry()
         reg.registerUtility(settings, ISettings)
         context = DummyContext()
-        request = DummyRequest({})
+        request = testing.DummyRequest({})
         class DummyView(object):
             pass
         view = DummyView()
@@ -159,7 +246,7 @@ class TestViewExecutionPermitted(unittest.TestCase):
         reg = get_current_registry()
         reg.registerUtility(settings, ISettings)
         context = DummyContext()
-        request = DummyRequest({})
+        request = testing.DummyRequest({})
         self.assertRaises(TypeError, self._callFUT, context, request, '')
 
     def test_with_permission(self):
@@ -171,232 +258,197 @@ class TestViewExecutionPermitted(unittest.TestCase):
         context = DummyContext()
         directlyProvides(context, IContext)
         self._registerSecuredView('', True)
-        request = DummyRequest({})
+        request = testing.DummyRequest({})
         directlyProvides(request, IRequest)
         result = self._callFUT(context, request, '')
-        self.assertTrue(result is True)
-
-class TestHasPermission(unittest.TestCase):
-    def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
-
-    def _callFUT(self, *arg):
-        from pyramid.security import has_permission
-        return has_permission(*arg)
-
-    def test_no_authentication_policy(self):
-        request = _makeRequest()
-        result = self._callFUT('view', None, request)
-        self.assertEqual(result, True)
-        self.assertEqual(result.msg, 'No authentication policy in use.')
-        
-    def test_authentication_policy_no_authorization_policy(self):
-        request = _makeRequest()
-        _registerAuthenticationPolicy(request.registry, None)
-        self.assertRaises(ValueError, self._callFUT, 'view', None, request)
-
-    def test_authn_and_authz_policies_registered(self):
-        request = _makeRequest()
-        _registerAuthenticationPolicy(request.registry, None)
-        _registerAuthorizationPolicy(request.registry, 'yo')
-        self.assertEqual(self._callFUT('view', None, request), 'yo')
-
-    def test_no_registry_on_request(self):
-        from pyramid.threadlocal import get_current_registry
-        request = DummyRequest({})
-        registry = get_current_registry()
-        _registerAuthenticationPolicy(registry, None)
-        _registerAuthorizationPolicy(registry, 'yo')
-        self.assertEqual(self._callFUT('view', None, request), 'yo')
+        self.assertTrue(result)
 
 class TestAuthenticatedUserId(unittest.TestCase):
     def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
+        testing.setUp()
 
-    def _callFUT(self, request):
-        from pyramid.security import authenticated_userid
-        return authenticated_userid(request)
+    def tearDown(self):
+        testing.tearDown()
+        
+    def test_backward_compat_delegates_to_mixin(self):
+        from zope.deprecation import __show__
+        try:
+            __show__.off()
+            request = _makeFakeRequest()
+            from pyramid.security import authenticated_userid
+            self.assertEqual(
+                authenticated_userid(request),
+                'authenticated_userid'
+                )
+        finally:
+            __show__.on()
 
     def test_no_authentication_policy(self):
         request = _makeRequest()
-        result = self._callFUT(request)
-        self.assertEqual(result, None)
+        self.assertEqual(request.authenticated_userid, None)
 
     def test_with_authentication_policy(self):
         request = _makeRequest()
         _registerAuthenticationPolicy(request.registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.authenticated_userid, 'yo')
 
     def test_with_authentication_policy_no_reg_on_request(self):
         from pyramid.threadlocal import get_current_registry
-        request = DummyRequest({})
         registry = get_current_registry()
+        request = _makeRequest()
+        del request.registry
         _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.authenticated_userid, 'yo')
 
-class TestUnauthenticatedUserId(unittest.TestCase):
+class TestUnAuthenticatedUserId(unittest.TestCase):
     def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
+        testing.setUp()
 
-    def _callFUT(self, request):
-        from pyramid.security import unauthenticated_userid
-        return unauthenticated_userid(request)
+    def tearDown(self):
+        testing.tearDown()
+        
+    def test_backward_compat_delegates_to_mixin(self):
+        from zope.deprecation import __show__
+        try:
+            __show__.off()
+            request = _makeFakeRequest()
+            from pyramid.security import unauthenticated_userid
+            self.assertEqual(
+                unauthenticated_userid(request),
+                'unauthenticated_userid',
+                )
+        finally:
+            __show__.on()
 
     def test_no_authentication_policy(self):
         request = _makeRequest()
-        result = self._callFUT(request)
-        self.assertEqual(result, None)
+        self.assertEqual(request.unauthenticated_userid, None)
 
     def test_with_authentication_policy(self):
         request = _makeRequest()
         _registerAuthenticationPolicy(request.registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.unauthenticated_userid, 'yo')
 
     def test_with_authentication_policy_no_reg_on_request(self):
         from pyramid.threadlocal import get_current_registry
-        request = DummyRequest({})
         registry = get_current_registry()
+        request = _makeRequest()
+        del request.registry
         _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.unauthenticated_userid, 'yo')
 
 class TestEffectivePrincipals(unittest.TestCase):
     def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
+        testing.setUp()
 
-    def _callFUT(self, request):
-        from pyramid.security import effective_principals
-        return effective_principals(request)
+    def tearDown(self):
+        testing.tearDown()
+        
+    def test_backward_compat_delegates_to_mixin(self):
+        request = _makeFakeRequest()
+        from zope.deprecation import __show__
+        try:
+            __show__.off()
+            from pyramid.security import effective_principals
+            self.assertEqual(
+                effective_principals(request),
+                'effective_principals'
+                )
+        finally:
+            __show__.on()
 
     def test_no_authentication_policy(self):
         from pyramid.security import Everyone
         request = _makeRequest()
-        result = self._callFUT(request)
-        self.assertEqual(result, [Everyone])
+        self.assertEqual(request.effective_principals, [Everyone])
 
     def test_with_authentication_policy(self):
         request = _makeRequest()
         _registerAuthenticationPolicy(request.registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.effective_principals, 'yo')
 
     def test_with_authentication_policy_no_reg_on_request(self):
         from pyramid.threadlocal import get_current_registry
         registry = get_current_registry()
-        request = DummyRequest({})
+        request = _makeRequest()
+        del request.registry
         _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.effective_principals, 'yo')
 
-class TestPrincipalsAllowedByPermission(unittest.TestCase):
-    def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
-
-    def _callFUT(self, *arg):
-        from pyramid.security import principals_allowed_by_permission
-        return principals_allowed_by_permission(*arg)
-
-    def test_no_authorization_policy(self):
-        from pyramid.security import Everyone
-        context = DummyContext()
-        result = self._callFUT(context, 'view')
-        self.assertEqual(result, [Everyone])
-
-    def test_with_authorization_policy(self):
-        from pyramid.threadlocal import get_current_registry
-        registry = get_current_registry()
-        _registerAuthorizationPolicy(registry, 'yo')
-        context = DummyContext()
-        result = self._callFUT(context, 'view')
-        self.assertEqual(result, 'yo')
-
-class TestRemember(unittest.TestCase):
+class TestHasPermission(unittest.TestCase):
     def setUp(self):
-        cleanUp()
+        testing.setUp()
         
     def tearDown(self):
-        cleanUp()
+        testing.tearDown()
 
-    def _callFUT(self, *arg):
-        from pyramid.security import remember
-        return remember(*arg)
+    def _makeOne(self):
+        from pyramid.security import AuthorizationAPIMixin
+        from pyramid.registry import Registry
+        mixin = AuthorizationAPIMixin()
+        mixin.registry = Registry()
+        mixin.context = object()
+        return mixin
+
+    def test_delegates_to_mixin(self):
+        from zope.deprecation import __show__
+        try:
+            __show__.off()
+            mixin = self._makeOne()
+            from pyramid.security import has_permission
+            self.called_has_permission = False
+
+            def mocked_has_permission(*args, **kw):
+                self.called_has_permission = True
+
+            mixin.has_permission = mocked_has_permission
+            has_permission('view', object(), mixin)
+            self.assertTrue(self.called_has_permission)
+        finally:
+            __show__.on()
 
     def test_no_authentication_policy(self):
-        request = _makeRequest()
-        result = self._callFUT(request, 'me')
-        self.assertEqual(result, [])
+        request = self._makeOne()
+        result = request.has_permission('view')
+        self.assertTrue(result)
+        self.assertEqual(result.msg, 'No authentication policy in use.')
 
-    def test_with_authentication_policy(self):
-        request = _makeRequest()
-        registry = request.registry
-        _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request, 'me')
-        self.assertEqual(result, 'yo')
+    def test_with_no_authorization_policy(self):
+        request = self._makeOne()
+        _registerAuthenticationPolicy(request.registry, None)
+        self.assertRaises(ValueError,
+                          request.has_permission, 'view', context=None)
 
-    def test_with_authentication_policy_no_reg_on_request(self):
+    def test_with_authn_and_authz_policies_registered(self):
+        request = self._makeOne()
+        _registerAuthenticationPolicy(request.registry, None)
+        _registerAuthorizationPolicy(request.registry, 'yo')
+        self.assertEqual(request.has_permission('view', context=None), 'yo')
+
+    def test_with_no_reg_on_request(self):
         from pyramid.threadlocal import get_current_registry
         registry = get_current_registry()
-        request = DummyRequest({})
-        _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request, 'me')
-        self.assertEqual(result, 'yo')
-
-class TestForget(unittest.TestCase):
-    def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
-
-    def _callFUT(self, *arg):
-        from pyramid.security import forget
-        return forget(*arg)
+        request = self._makeOne()
+        del request.registry
+        _registerAuthenticationPolicy(registry, None)
+        _registerAuthorizationPolicy(registry, 'yo')
+        self.assertEqual(request.has_permission('view'), 'yo')
 
-    def test_no_authentication_policy(self):
-        request = _makeRequest()
-        result = self._callFUT(request)
-        self.assertEqual(result, [])
+    def test_with_no_context_passed(self):
+        request = self._makeOne()
+        self.assertTrue(request.has_permission('view'))
 
-    def test_with_authentication_policy(self):
-        request = _makeRequest()
-        _registerAuthenticationPolicy(request.registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+    def test_with_no_context_passed_or_on_request(self):
+        request = self._makeOne()
+        del request.context
+        self.assertRaises(AttributeError, request.has_permission, 'view')
 
-    def test_with_authentication_policy_no_reg_on_request(self):
-        from pyramid.threadlocal import get_current_registry
-        registry = get_current_registry()
-        request = DummyRequest({})
-        _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+_TEST_HEADER = 'X-Pyramid-Test'
 
 class DummyContext:
     def __init__(self, *arg, **kw):
         self.__dict__.update(kw)
 
-class DummyRequest:
-    def __init__(self, environ):
-        self.environ = environ
-
 class DummyAuthenticationPolicy:
     def __init__(self, result):
         self.result = result
@@ -411,10 +463,14 @@ class DummyAuthenticationPolicy:
         return self.result
 
     def remember(self, request, principal, **kw):
-        return self.result
+        headers = [(_TEST_HEADER, principal)]
+        self._header_remembered = headers[0]
+        return headers
 
     def forget(self, request):
-        return self.result
+        headers = [(_TEST_HEADER, 'logout')]
+        self._header_forgotten = headers[0]
+        return headers
 
 class DummyAuthorizationPolicy:
     def __init__(self, result):
@@ -440,8 +496,24 @@ def _registerAuthorizationPolicy(reg, result):
 
 def _makeRequest():
     from pyramid.registry import Registry
-    request = DummyRequest({})
+    request = testing.DummyRequest(environ={})
     request.registry = Registry()
+    request.context = object()
     return request
 
+def _makeFakeRequest():
+    class FakeRequest(testing.DummyRequest):
+        @property
+        def authenticated_userid(req):
+            return 'authenticated_userid'
+
+        @property
+        def unauthenticated_userid(req):
+            return 'unauthenticated_userid'
+
+        @property
+        def effective_principals(req):
+            return 'effective_principals'
+
+    return FakeRequest({})