Merge branch 'master' of github.com:Pylons/pyramid

71 files changed, 2060 insertions, 835 deletions

diff --git a/.travis.yml b/.travis.yml
index 9d4324ff8..29e499e76 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -6,6 +6,9 @@ python:
   - 2.7
   - pypy
   - 3.2
+  - 3.3
+
+install: python setup.py dev
 
 script: python setup.py test -q
 
diff --git a/CHANGES.txt b/CHANGES.txt
index a228fbb3a..98784f3d7 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -4,12 +4,68 @@ Unreleased
 Features
 --------
 
+- An authorization API has been added as a method of the
+  request: ``request.has_permission``.
+
+  ``request.has_permission`` is a method-based alternative to the
+  ``pyramid.security.has_permission`` API and works exactly the same.  The
+  older API is now deprecated.
+
+- Property API attributes have been added to the request for easier access to
+  authentication data: ``request.authenticated_userid``,
+  ``request.unauthenticated_userid``, and ``request.effective_principals``.
+
+  These are analogues, respectively, of
+  ``pyramid.security.authenticated_userid``,
+  ``pyramid.security.unauthenticated_userid``, and
+  ``pyramid.security.effective_principals``.  They operate exactly the same,
+  except they are attributes of the request instead of functions accepting a
+  request.  They are properties, so they cannot be assigned to.  The older
+  function-based APIs are now deprecated.
+
 - Pyramid's console scripts (``pserve``, ``pviews``, etc) can now be run
   directly, allowing custom arguments to be sent to the python interpreter
   at runtime. For example::
 
       python -3 -m pyramid.scripts.pserve development.ini
 
+- Added a specific subclass of ``HTTPBadRequest`` named
+  ``pyramid.exceptions.BadCSRFToken`` which will now be raised in response
+  to failures in ``check_csrf_token``.
+  See https://github.com/Pylons/pyramid/pull/1149
+
+- Added a new ``SignedCookieSessionFactory`` which is very similar to the
+  ``UnencryptedCookieSessionFactoryConfig`` but with a clearer focus on
+  signing content. The custom serializer arguments to this function should
+  only focus on serializing, unlike its predecessor which required the
+  serializer to also perform signing.
+  See https://github.com/Pylons/pyramid/pull/1142
+
+- Added a new ``BaseCookieSessionFactory`` which acts as a generic cookie
+  factory that can be used by framework implementors to create their own
+  session implementations. It provides a reusable API which focuses strictly
+  on providing a dictionary-like object that properly handles renewals,
+  timeouts, and conformance with the ``ISession`` API.
+  See https://github.com/Pylons/pyramid/pull/1142
+
+- The anchor argument to ``pyramid.request.Request.route_url`` and
+  ``pyramid.request.Request.resource_url`` and their derivatives will now be
+  escaped via URL quoting to ensure minimal conformance.  See
+  https://github.com/Pylons/pyramid/pull/1183
+
+- Allow sending of ``_query`` and ``_anchor`` options to
+  ``pyramid.request.Request.static_url`` when an external URL is being
+  generated.
+  See https://github.com/Pylons/pyramid/pull/1183
+
+- You can now send a string as the ``_query`` argument to
+  ``pyramid.request.Request.route_url`` and
+  ``pyramid.request.Request.resource_url`` and their derivatives.  When a
+  string is sent instead of a list or dictionary. it is URL-quoted however it
+  does not need to be in ``k=v`` form.  This is useful if you want to be able
+  to use a different query string format than ``x-www-form-urlencoded``.  See
+  https://github.com/Pylons/pyramid/pull/1183
+
 Bug Fixes
 ---------
 
@@ -32,6 +88,16 @@ Bug Fixes
 
 - Remove unused ``renderer`` argument from ``Configurator.add_route``.
 
+- Allow the ``BasicAuthenticationPolicy`` to work with non-ascii usernames
+  and passwords. The charset is not passed as part of the header and different
+  browsers alternate between UTF-8 and Latin-1, so the policy now attempts
+  to decode with UTF-8 first, and will fallback to Latin-1.
+  See https://github.com/Pylons/pyramid/pull/1170
+
+- The ``@view_defaults`` now apply to notfound and forbidden views
+  that are defined as methods of a decorated class.
+  See https://github.com/Pylons/pyramid/issues/1173
+
 Documentation
 -------------
 
@@ -40,6 +106,9 @@ Documentation
 - Removed mention of ``pyramid_beaker`` from docs.  Beaker is no longer 
   maintained.  Point people at ``pyramid_redis_sessions`` instead.
 
+- Add documentation for ``pyramid.interfaces.IRendererFactory`` and
+  ``pyramid.interfaces.IRenderer``.
+
 Backwards Incompatibilities
 ---------------------------
 
@@ -50,6 +119,36 @@ Backwards Incompatibilities
   situation, leaving a query string of ``a=b&key=``.
   See https://github.com/Pylons/pyramid/issues/1119
 
+Deprecations
+------------
+
+- Deprecate the ``pyramid.interfaces.ITemplateRenderer`` interface. It was
+  ill-defined and became unused when Mako and Chameleon template bindings were
+  split into their own packages.
+
+- The ``pyramid.session.UnencryptedCookieSessionFactoryConfig`` API has been 
+  deprecated and is superseded by the 
+  ``pyramid.session.SignedCookieSessionFactory``.  Note that while the cookies
+  generated by the ``UnencryptedCookieSessionFactoryConfig``
+  are compatible with cookies generated by old releases, cookies generated by
+  the SignedCookieSessionFactory are not. See 
+  https://github.com/Pylons/pyramid/pull/1142
+
+- The ``pyramid.security.has_permission`` API is now deprecated.  Instead, use
+  the newly-added ``has_permission`` method of the request object.
+
+- The ``pyramid.security.effective_principals`` API is now deprecated.
+  Instead, use the newly-added ``effective_principals`` attribute of the
+  request object.
+
+- The ``pyramid.security.authenticated_userid`` API is now deprecated.
+  Instead, use the newly-added ``authenticated_userid`` attribute of the
+  request object.
+
+- The ``pyramid.security.unauthenticated_userid`` API is now deprecated.
+  Instead, use the newly-added ``unauthenticated_userid`` attribute of the
+  request object.
+
 1.5a2 (2013-09-22)
 ==================
 
diff --git a/CONTRIBUTORS.txt b/CONTRIBUTORS.txt
index bfe22e540..63528e662 100644
--- a/CONTRIBUTORS.txt
+++ b/CONTRIBUTORS.txt
@@ -224,3 +224,7 @@ Contributors
 - Doug Hellmann, 2013/09/06
 
 - Karl O. Pinc, 2013/09/27
+
+- Matthew Russell, 2013/10/14
+
+- Antti Haapala, 2013/11/15
diff --git a/HACKING.txt b/HACKING.txt
index b32a8a957..12f2d68e2 100644
--- a/HACKING.txt
+++ b/HACKING.txt
@@ -6,9 +6,9 @@ Here are some guidelines about hacking on Pyramid.
 Using a Development Checkout
 ----------------------------
 
-You'll have to create a development environment to hack on Pyramid, using a 
-Pyramid checkout.   You can either do this by hand or, if you have ``tox`` 
-installed (it's on PyPI), you can (ab)use tox to get a working development 
+You'll have to create a development environment to hack on Pyramid, using a
+Pyramid checkout.   You can either do this by hand or, if you have ``tox``
+installed (it's on PyPI), you can (ab)use tox to get a working development
 environment.  Each installation method is described below.
 
 By Hand
@@ -25,15 +25,15 @@ By Hand
    $ cd ~/hack-on-pyramid
    $ virtualenv -ppython2.7 env
 
-  Note that very old versions of virtualenv (virtualenv versions below, say, 
+  Note that very old versions of virtualenv (virtualenv versions below, say,
   1.10 or thereabouts) require you to pass a ``--no-site-packages`` flag to
   get a completely isolated environment.
 
-  You can choose which Python version you want to use by passing a ``-p`` 
+  You can choose which Python version you want to use by passing a ``-p``
   flag to ``virtualenv``.  For example, ``virtualenv -ppython2.7``
   chooses the Python 2.7 interpreter to be installed.
 
-  From here on in within these instructions, the ``~/hack-on-pyramid/env`` 
+  From here on in within these instructions, the ``~/hack-on-pyramid/env``
   virtual environment you created above will be referred to as ``$VENV``.
   To use the instructions in the steps that follow literally, use the
   ``export VENV=~/hack-on-pyramid/env`` command.
@@ -132,7 +132,7 @@ Coding Style
 
 - PEP8 compliance.  Whitespace rules are relaxed: not necessary to put
   2 newlines between classes.  But 80-column lines, in particular, are
-  mandatory.  See 
+  mandatory.  See
   http://docs.pylonsproject.org/en/latest/community/codestyle.html for more
   information.
 
@@ -142,14 +142,14 @@ Coding Style
 Running Tests
 --------------
 
-- To run all tests for Pyramid on a single Python version, run ``nosetests`` 
+- To run all tests for Pyramid on a single Python version, run ``nosetests``
   from your development virtualenv (See *Using a Development Checkout* above).
 
 - To run individual tests (i.e. during development) you can use a regular
   expression with the ``-t`` parameter courtesy of the `nose-selecttests
-  <https://pypi.python.org/pypi/nose-selecttests/>`_ plugin that's been 
-  installed (along with nose itself) via ``python setup.py dev``. The 
-  easiest usage is to simply provide the verbatim name of the test you're 
+  <https://pypi.python.org/pypi/nose-selecttests/>`_ plugin that's been
+  installed (along with nose itself) via ``python setup.py dev``. The
+  easiest usage is to simply provide the verbatim name of the test you're
   working on.
 
 - To run the full set of Pyramid tests on all platforms, install ``tox``
@@ -191,8 +191,8 @@ or adds the feature.
 To build and review docs (where ``$VENV`` refers to the virtualenv you're
 using to develop Pyramid):
 
-1. After following the steps above in "Using a Development Checkout", cause 
-   Sphinx and all development requirements to be installed in your 
+1. After following the steps above in "Using a Development Checkout", cause
+   Sphinx and all development requirements to be installed in your
    virtualenv::
 
      $ cd ~/hack-on-pyramid
@@ -212,9 +212,9 @@ using to develop Pyramid):
      $ cd ~/hack-on-pyramid/pyramid/docs
      $ make clean html SPHINXBUILD=$VENV/bin/sphinx-build
 
-   The ``SPHINXBUILD=...`` hair is there in order to tell it to use the
-   virtualenv Python, which will have both Sphinx and Pyramid (for API
-   documentation generation) installed.
+   The ``SPHINXBUILD=...`` argument tells Sphinx to use the virtualenv Python,
+   which will have both Sphinx and Pyramid (for API documentation generation)
+   installed.
 
 4. Open the ``docs/_build/html/index.html`` file to see the resulting HTML
    rendering.
diff --git a/docs/api/exceptions.rst b/docs/api/exceptions.rst
index ab158f18d..0c630571f 100644
--- a/docs/api/exceptions.rst
+++ b/docs/api/exceptions.rst
@@ -5,6 +5,8 @@
 
 .. automodule:: pyramid.exceptions
 
+  .. autoclass:: BadCSRFToken
+
   .. autoclass:: PredicateMismatch
 
   .. autoclass:: Forbidden
diff --git a/docs/api/httpexceptions.rst b/docs/api/httpexceptions.rst
index 6a08d1048..b50f10beb 100644
--- a/docs/api/httpexceptions.rst
+++ b/docs/api/httpexceptions.rst
@@ -7,9 +7,9 @@
 
   .. attribute:: status_map
 
-     A mapping of integer status code to exception class (eg. the
-     integer "401" maps to
-     :class:`pyramid.httpexceptions.HTTPUnauthorized`).
+     A mapping of integer status code to HTTP exception class (eg. the integer
+     "401" maps to :class:`pyramid.httpexceptions.HTTPUnauthorized`).  All
+     mapped exception classes are children of :class:`pyramid.httpexceptions`,
 
   .. autofunction:: exception_response
 
diff --git a/docs/api/interfaces.rst b/docs/api/interfaces.rst
index 1dea5fab0..d8d935afd 100644
--- a/docs/api/interfaces.rst
+++ b/docs/api/interfaces.rst
@@ -50,7 +50,10 @@ Other Interfaces
   .. autointerface:: IRendererInfo
      :members:
 
-  .. autointerface:: ITemplateRenderer
+  .. autointerface:: IRendererFactory
+     :members:
+
+  .. autointerface:: IRenderer
      :members:
 
   .. autointerface:: IViewMapperFactory
diff --git a/docs/api/renderers.rst b/docs/api/renderers.rst
index ea000ad02..0caca02b4 100644
--- a/docs/api/renderers.rst
+++ b/docs/api/renderers.rst
@@ -13,8 +13,12 @@
 
 .. autoclass:: JSON
 
+   .. automethod:: add_adapter
+
 .. autoclass:: JSONP
 
+   .. automethod:: add_adapter
+
 .. attribute:: null_renderer
 
    An object that can be used in advanced integration cases as input to the
diff --git a/docs/api/request.rst b/docs/api/request.rst
index 72abddb68..b7604020e 100644
--- a/docs/api/request.rst
+++ b/docs/api/request.rst
@@ -11,7 +11,9 @@
    :exclude-members: add_response_callback, add_finished_callback,
                      route_url, route_path, current_route_url,
                      current_route_path, static_url, static_path,
-                     model_url, resource_url, set_property
+                     model_url, resource_url, set_property, 
+                     effective_principals, authenticated_userid,
+                     unauthenticated_userid, has_permission
 
    .. attribute:: context
 
@@ -161,6 +163,42 @@
       request, the value of this attribute will be ``None``. See
       :ref:`matched_route`.
 
+   .. attribute:: authenticated_userid
+
+      .. versionadded:: 1.5
+
+      A property which returns the userid of the currently authenticated user
+      or ``None`` if there is no :term:`authentication policy` in effect or
+      there is no currently authenticated user.  This differs from
+      :attr:`~pyramid.request.Request.unauthenticated_userid`, because the
+      effective authentication policy will have ensured that a record
+      associated with the userid exists in persistent storage; if it has
+      not, this value will be ``None``.
+
+   .. attribute:: unauthenticated_userid
+
+      .. versionadded:: 1.5
+
+      A property which returns a value which represents the *claimed* (not
+      verified) user id of the credentials present in the request. ``None`` if
+      there is no :term:`authentication policy` in effect or there is no user
+      data associated with the current request.  This differs from
+      :attr:`~pyramid.request.Request.authenticated_userid`, because the
+      effective authentication policy will not ensure that a record associated
+      with the userid exists in persistent storage.  Even if the userid
+      does not exist in persistent storage, this value will be the value
+      of the userid *claimed* by the request data.
+
+   .. attribute:: effective_principals
+
+      .. versionadded:: 1.5
+
+      A property which returns the list of 'effective' :term:`principal`
+      identifiers for this request.  This will include the userid of the
+      currently authenticated user if a user is currently authenticated. If no
+      :term:`authentication policy` is in effect, this will return a sequence
+      containing only the :attr:`pyramid.security.Everyone` principal.
+
    .. method:: invoke_subrequest(request, use_tweens=False)
 
       .. versionadded:: 1.4a1
@@ -215,6 +253,8 @@
       request provided by e.g. the ``pshell`` environment.  For more
       information, see :ref:`subrequest_chapter`.
 
+   .. automethod:: has_permission
+
    .. automethod:: add_response_callback
 
    .. automethod:: add_finished_callback
diff --git a/docs/api/session.rst b/docs/api/session.rst
index 31bc196ad..dde9d20e9 100644
--- a/docs/api/session.rst
+++ b/docs/api/session.rst
@@ -5,12 +5,16 @@
 
 .. automodule:: pyramid.session
 
-  .. autofunction:: UnencryptedCookieSessionFactoryConfig
-
   .. autofunction:: signed_serialize
 
   .. autofunction:: signed_deserialize
 
   .. autofunction:: check_csrf_token
 
+  .. autofunction:: SignedCookieSessionFactory
+
+  .. autofunction:: UnencryptedCookieSessionFactoryConfig
+
+  .. autofunction:: BaseCookieSessionFactory
+
 
diff --git a/docs/designdefense.rst b/docs/designdefense.rst
index bbce3e29c..2f3c14881 100644
--- a/docs/designdefense.rst
+++ b/docs/designdefense.rst
@@ -1078,7 +1078,7 @@ The contents of ``app2.py``:
 The contents of ``config.py``:
 
 .. code-block:: python
-  :linenos:
+    :linenos:
 
     L = []
 
diff --git a/docs/narr/events.rst b/docs/narr/events.rst
index 2accb3dbe..50484761d 100644
--- a/docs/narr/events.rst
+++ b/docs/narr/events.rst
@@ -172,7 +172,7 @@ track of the information that subscribers will need. Here are some
 example custom event classes:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     class DocCreated(object):
         def __init__(self, doc, request):
@@ -196,7 +196,7 @@ also use custom events with :ref:`subscriber predicates
 event with a decorator:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from pyramid.events import subscriber
     from .events import DocCreated
@@ -215,7 +215,7 @@ To fire your custom events use the
 accessed as ``request.registry.notify``. For example:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from .events import DocCreated
 
diff --git a/docs/narr/extending.rst b/docs/narr/extending.rst
index a60a49fea..8462a9da7 100644
--- a/docs/narr/extending.rst
+++ b/docs/narr/extending.rst
@@ -234,7 +234,7 @@ For example, if the original application has the following
 ``configure_views`` configuration method:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     def configure_views(config):
         config.add_view('theoriginalapp.views.theview', name='theview')
diff --git a/docs/narr/hooks.rst b/docs/narr/hooks.rst
index 0c450fad7..f2542f1d7 100644
--- a/docs/narr/hooks.rst
+++ b/docs/narr/hooks.rst
@@ -363,7 +363,7 @@ and modify the set of :term:`renderer globals` before they are passed to a
 that can be used for this purpose.  For example:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from pyramid.events import subscriber
     from pyramid.events import BeforeRender
@@ -963,8 +963,8 @@ For full details, please read the `Venusian documentation
 
 .. _registering_tweens:
 
-Registering "Tweens"
---------------------
+Registering Tweens
+------------------
 
 .. versionadded:: 1.2
    Tweens
@@ -976,26 +976,80 @@ feature that may be used by Pyramid framework extensions, to provide, for
 example, Pyramid-specific view timing support bookkeeping code that examines
 exceptions before they are returned to the upstream WSGI application.  Tweens
 behave a bit like :term:`WSGI` :term:`middleware` but they have the benefit of
-running in a context in which they have access to the Pyramid
-:term:`application registry` as well as the Pyramid rendering machinery.
+running in a context in which they have access to the Pyramid :term:`request`,
+:term:`response` and :term:`application registry` as well as the Pyramid
+rendering machinery.
 
-Creating a Tween Factory
-~~~~~~~~~~~~~~~~~~~~~~~~
+Creating a Tween
+~~~~~~~~~~~~~~~~
 
-To make use of tweens, you must construct a "tween factory".  A tween factory
+To create a tween, you must write a "tween factory".  A tween factory
 must be a globally importable callable which accepts two arguments:
 ``handler`` and ``registry``.  ``handler`` will be the either the main
 Pyramid request handling function or another tween.  ``registry`` will be the
 Pyramid :term:`application registry` represented by this Configurator.  A
-tween factory must return a tween when it is called.
+tween factory must return the tween (a callable object) when it is called.
 
-A tween is a callable which accepts a :term:`request` object and returns
-a :term:`response` object.
+A tween is called with a single argument, ``request``, which is the
+:term:`request` created by Pyramid's router when it receives a WSGI request.
+A tween should return a :term:`response`, usually the one generated by the
+downstream Pyramid application.
 
-Here's an example of a tween factory:
+You can write the tween factory as a simple closure-returning function:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
+
+    def simple_tween_factory(handler, registry):
+        # one-time configuration code goes here
+
+        def simple_tween(request):
+            # code to be executed for each request before
+            # the actual application code goes here
+
+            response = handler(request)
+
+            # code to be executed for each request after
+            # the actual application code goes here
+
+            return response
+
+        return simple_tween
+
+Alternatively, the tween factory can be a class with the ``__call__`` magic
+method:
+
+.. code-block:: python
+    :linenos:
+
+    class simple_tween_factory(object):
+        def __init__(handler, registry):
+            self.handler = handler
+            self.registry = registry
+
+            # one-time configuration code goes here
+
+        def __call__(self, request):
+            # code to be executed for each request before
+            # the actual application code goes here
+
+            response = self.handler(request)
+
+            # code to be executed for each request after
+            # the actual application code goes here
+
+            return response
+
+The closure style performs slightly better and enables you to conditionally
+omit the tween from the request processing pipeline (see the following timing
+tween example), whereas the class style makes it easier to have shared mutable
+state, and it allows subclassing.
+
+Here's a complete example of a tween that logs the time spent processing each
+request:
+
+.. code-block:: python
+    :linenos:
 
     # in a module named myapp.tweens
 
@@ -1022,12 +1076,6 @@ Here's an example of a tween factory:
         # handler
         return handler
 
-If you remember, a tween is an object which accepts a :term:`request` object
-and which returns a :term:`response` argument.  The ``request`` argument to a
-tween will be the request created by Pyramid's router when it receives a WSGI
-request.  The response object will be generated by the downstream Pyramid
-application and it should be returned by the tween.
-
 In the above example, the tween factory defines a ``timing_tween`` tween and
 returns it if ``asbool(registry.settings.get('do_timing'))`` is true.  It
 otherwise simply returns the handler it was given.  The ``registry.settings``
@@ -1053,7 +1101,7 @@ Here's an example of registering a tween factory as an "implicit" tween in a
 Pyramid application:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from pyramid.config import Configurator
     config = Configurator()
@@ -1087,7 +1135,7 @@ chain (the tween generated by the very last tween factory added) as its
 request handler function.  For example:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from pyramid.config import Configurator
 
@@ -1132,8 +1180,10 @@ Allowable values for ``under`` or ``over`` (or both) are:
   fallbacks if the desired tween is not included, as well as compatibility
   with multiple other tweens.
 
-Effectively, ``under`` means "closer to the main Pyramid application than",
-``over`` means "closer to the request ingress than".
+Effectively, ``over`` means "closer to the request ingress than" and
+``under`` means "closer to the main Pyramid application than".
+You can think of an onion with outer layers over the inner layers,
+the application being under all the layers at the center.
 
 For example, the following call to
 :meth:`~pyramid.config.Configurator.add_tween` will attempt to place the
@@ -1329,7 +1379,7 @@ route predicate factory is most often a class with a constructor
 method. For example:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     class ContentTypePredicate(object):
         def __init__(self, val, config):
@@ -1392,7 +1442,7 @@ with a subscriber that subscribes to the :class:`pyramid.events.NewRequest`
 event type.
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     class RequestPathStartsWith(object):
         def __init__(self, val, config):
@@ -1421,7 +1471,7 @@ previously registered ``request_path_startswith`` predicate in a call to
 :meth:`~pyramid.config.Configurator.add_subscriber`:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     # define a subscriber in your code
 
@@ -1437,7 +1487,7 @@ Here's the same subscriber/predicate/event-type combination used via
 :class:`~pyramid.events.subscriber`.
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from pyramid.events import subscriber
 
diff --git a/docs/narr/hybrid.rst b/docs/narr/hybrid.rst
index a29ccb2ac..4a3258d35 100644
--- a/docs/narr/hybrid.rst
+++ b/docs/narr/hybrid.rst
@@ -63,7 +63,7 @@ An application that uses only traversal will have view configuration
 declarations that look like this:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     # config is an instance of pyramid.config.Configurator
 
diff --git a/docs/narr/i18n.rst b/docs/narr/i18n.rst
index b62c16ff0..c9b782c08 100644
--- a/docs/narr/i18n.rst
+++ b/docs/narr/i18n.rst
@@ -309,7 +309,7 @@ In particular, add the ``Babel`` and ``lingua`` distributions to the
 application's ``setup.py`` file:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     setup(name="mypackage",
           # ...
@@ -370,7 +370,7 @@ file of a ``pcreate`` -generated :app:`Pyramid` application has stanzas in it
 that look something like the following:
 
 .. code-block:: ini
-   :linenos:
+    :linenos:
 
     [compile_catalog]
     directory = myproject/locale
@@ -398,7 +398,7 @@ that you'd like the domain of your translations to be ``mydomain``
 instead, change the ``setup.cfg`` file stanzas to look like so:
 
 .. code-block:: ini
-   :linenos:
+    :linenos:
 
     [compile_catalog]
     directory = myproject/locale
@@ -1041,7 +1041,7 @@ if no locale can be determined.
 Here's an implementation of a simple locale negotiator:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     def my_locale_negotiator(request):
         locale_name = request.params.get('my_locale')
diff --git a/docs/narr/introduction.rst b/docs/narr/introduction.rst
index a9c5fdfbd..8acbab3a0 100644
--- a/docs/narr/introduction.rst
+++ b/docs/narr/introduction.rst
@@ -336,7 +336,7 @@ For example, instead of returning a ``Response`` object from a
 ``render_to_response`` call:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from pyramid.renderers import render_to_response
 
@@ -347,7 +347,7 @@ For example, instead of returning a ``Response`` object from a
 You can return a Python dictionary:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from pyramid.view import view_config
 
@@ -827,7 +827,7 @@ Here's an example of using Pyramid's introspector from within a view
 callable:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from pyramid.view import view_config
     from pyramid.response import Response
diff --git a/docs/narr/introspector.rst b/docs/narr/introspector.rst
index 3c0a6744f..a7bde4cf7 100644
--- a/docs/narr/introspector.rst
+++ b/docs/narr/introspector.rst
@@ -24,7 +24,7 @@ Here's an example of using Pyramid's introspector from within a view
 callable:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from pyramid.view import view_config
     from pyramid.response import Response
@@ -100,7 +100,7 @@ its ``__getitem__``, ``get``, ``keys``, ``values``, or ``items`` methods.
 For example:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     route_intr = introspector.get('routes', 'edit_user')
     pattern = route_intr['pattern']
diff --git a/docs/narr/logging.rst b/docs/narr/logging.rst
index b3bfb8a1e..75428d513 100644
--- a/docs/narr/logging.rst
+++ b/docs/narr/logging.rst
@@ -179,7 +179,7 @@ file, simply create a logger object using the ``__name__`` builtin and call
 methods on it.
 
 .. code-block:: python 
-   :linenos:
+    :linenos:
 
     import logging 
     log = logging.getLogger(__name__) 
diff --git a/docs/narr/paste.rst b/docs/narr/paste.rst
index 3427b6d53..f1fb70869 100644
--- a/docs/narr/paste.rst
+++ b/docs/narr/paste.rst
@@ -87,7 +87,7 @@ configuration object and *returns* an instance of our application.
 
 .. _defaults_section_of_pastedeploy_file:
 
-``[DEFAULTS]`` Section of a PasteDeploy ``.ini`` File
+``[DEFAULT]`` Section of a PasteDeploy ``.ini`` File
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 You can add a ``[DEFAULT]`` section to your PasteDeploy ``.ini`` file.  Such
diff --git a/docs/narr/renderers.rst b/docs/narr/renderers.rst
index 740c81555..4f8c4bf77 100644
--- a/docs/narr/renderers.rst
+++ b/docs/narr/renderers.rst
@@ -480,8 +480,11 @@ Adding a New Renderer
 You may add a new renderer by creating and registering a :term:`renderer
 factory`.
 
-A renderer factory implementation is typically a class with the
-following interface:
+A renderer factory implementation should conform to the
+:class:`pyramid.interfaces.IRendererFactory` interface. It should be capable
+of creating an object that conforms to the
+:class:`pyramid.interfaces.IRenderer` interface. A typical class that follows
+this setup is as follows:
 
 .. code-block:: python
    :linenos:
diff --git a/docs/narr/resources.rst b/docs/narr/resources.rst
index b1bb611e5..f3ff1dc4c 100644
--- a/docs/narr/resources.rst
+++ b/docs/narr/resources.rst
@@ -83,7 +83,7 @@ works against resource instances.
 Here's a sample resource tree, represented by a variable named ``root``:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     class Resource(dict):
         pass
@@ -201,7 +201,7 @@ location-aware resources.  These APIs include (but are not limited to)
 :func:`~pyramid.traversal.resource_path`,
 :func:`~pyramid.traversal.resource_path_tuple`, or
 :func:`~pyramid.traversal.traverse`, :func:`~pyramid.traversal.virtual_root`,
-and (usually) :func:`~pyramid.security.has_permission` and
+and (usually) :meth:`~pyramid.request.Request.has_permission` and
 :func:`~pyramid.security.principals_allowed_by_permission`.
 
 In general, since so much :app:`Pyramid` infrastructure depends on
@@ -695,10 +695,10 @@ The APIs provided by :ref:`location_module` are used against resources.
 These can be used to walk down a resource tree, or conveniently locate one
 resource "inside" another.
 
-Some APIs in :ref:`security_module` accept a resource object as a parameter.
-For example, the :func:`~pyramid.security.has_permission` API accepts a
+Some APIs on the :class:`pyramid.request.Request` accept a resource object as a parameter.
+For example, the :meth:`~pyramid.request.Request.has_permission` API accepts a
 resource object as one of its arguments; the ACL is obtained from this
-resource or one of its ancestors.  Other APIs in the :mod:`pyramid.security`
-module also accept :term:`context` as an argument, and a context is always a
-resource.
+resource or one of its ancestors.  Other security related APIs on the 
+:class:`pyramid.request.Request` class also accept :term:`context` as an argument, 
+and a context is always a resource.
 
diff --git a/docs/narr/scaffolding.rst b/docs/narr/scaffolding.rst
index 534b2caf4..f924d0d62 100644
--- a/docs/narr/scaffolding.rst
+++ b/docs/narr/scaffolding.rst
@@ -39,9 +39,9 @@ named ``__init__.py`` with something like the following:
 
    from pyramid.scaffolds import PyramidTemplate
 
-     class CoolExtensionTemplate(PyramidTemplate):
-         _template_dir = 'coolextension_scaffold'
-         summary = 'My cool extension'
+   class CoolExtensionTemplate(PyramidTemplate):
+       _template_dir = 'coolextension_scaffold'
+       summary = 'My cool extension'
 
 Once this is done, within the ``scaffolds`` directory, create a template
 directory.  Our example used a template directory named
@@ -89,7 +89,7 @@ For example:
             [pyramid.scaffold]
             coolextension=coolextension.scaffolds:CoolExtensionTemplate
           """
-         )
+        )
 
 Run your distribution's ``setup.py develop`` or ``setup.py install``
 command. After that, you should be able to see your scaffolding template
@@ -112,7 +112,7 @@ want to have extension scaffolds that can work across Pyramid 1.0.X, 1.1.X,
 defining your scaffold template:
 
 .. code-block:: python
-   :linenos:
+     :linenos:
 
      try: # pyramid 1.0.X
          # "pyramid.paster.paste_script..." doesn't exist past 1.0.X
diff --git a/docs/narr/security.rst b/docs/narr/security.rst
index 6517fedf8..9e6fb6c82 100644
--- a/docs/narr/security.rst
+++ b/docs/narr/security.rst
@@ -550,7 +550,7 @@ also contain security debugging information in its body.
 Debugging Imperative Authorization Failures
 -------------------------------------------
 
-The :func:`pyramid.security.has_permission` API is used to check
+The :meth:`pyramid.request.Request.has_permission` API is used to check
 security within view functions imperatively.  It returns instances of
 objects that are effectively booleans.  But these objects are not raw
 ``True`` or ``False`` objects, and have information attached to them
@@ -563,7 +563,7 @@ one of :data:`pyramid.security.ACLAllowed`,
 ``msg`` attribute, which is a string indicating why the permission was
 denied or allowed.  Introspecting this information in the debugger or
 via print statements when a call to
-:func:`~pyramid.security.has_permission` fails is often useful.
+:meth:`~pyramid.request.Request.has_permission` fails is often useful.
 
 .. index::
    single: authentication policy (creating)
@@ -669,3 +669,31 @@ following interface:
 After you do so, you can pass an instance of such a class into the
 :class:`~pyramid.config.Configurator.set_authorization_policy` method at
 configuration time to use it.
+
+.. _admonishment_against_secret_sharing:
+
+Admonishment Against Secret-Sharing
+-----------------------------------
+
+A "secret" is required by various components of Pyramid.  For example, the
+:term:`authentication policy` below uses a secret value ``seekrit``::
+
+  authn_policy = AuthTktAuthenticationPolicy('seekrit', hashalg='sha512')
+
+A :term:`session factory` also requires a secret::
+
+  my_session_factory = SignedCookieSessionFactory('itsaseekreet')
+
+It is tempting to use the same secret for multiple Pyramid subsystems.  For
+example, you might be tempted to use the value ``seekrit`` as the secret for
+both the authentication policy and the session factory defined above.  This is
+a bad idea, because in both cases, these secrets are used to sign the payload
+of the data.
+
+If you use the same secret for two different parts of your application for
+signing purposes, it may allow an attacker to get his chosen plaintext signed,
+which would allow the attacker to control the content of the payload.  Re-using
+a secret across two different subsystems might drop the security of signing to
+zero. Keys should not be re-used across different contexts where an attacker
+has the possibility of providing a chosen plaintext.
+
diff --git a/docs/narr/sessions.rst b/docs/narr/sessions.rst
index f33bc6132..fb5035373 100644
--- a/docs/narr/sessions.rst
+++ b/docs/narr/sessions.rst
@@ -43,24 +43,23 @@ limitations:
 It is digitally signed, however, and thus its data cannot easily be
 tampered with.
 
-You can configure this session factory in your :app:`Pyramid`
-application by using the ``session_factory`` argument to the
-:class:`~pyramid.config.Configurator` class:
+You can configure this session factory in your :app:`Pyramid` application
+by using the :meth:`pyramid.config.Configurator.set_session_factory`` method.
 
 .. code-block:: python
    :linenos:
 
-   from pyramid.session import UnencryptedCookieSessionFactoryConfig
-   my_session_factory = UnencryptedCookieSessionFactoryConfig('itsaseekreet')
-   
+   from pyramid.session import SignedCookieSessionFactory
+   my_session_factory = SignedCookieSessionFactory('itsaseekreet')
+
    from pyramid.config import Configurator
-   config = Configurator(session_factory = my_session_factory)
+   config = Configurator()
+   config.set_session_factory(my_session_factory)
 
 .. warning:: 
 
-   Note the very long, very explicit name for
-   ``UnencryptedCookieSessionFactoryConfig``.  It's trying to tell you that
-   this implementation is, by default, *unencrypted*.  You should not use it
+   By default the :func:`~pyramid.session.SignedCookieSessionFactory`
+   implementation is *unencrypted*.  You should not use it
    when you keep sensitive information in the session object, as the
    information can be easily read by both users of your application and third
    parties who have access to your users' network traffic.  And if you use this
diff --git a/docs/narr/testing.rst b/docs/narr/testing.rst
index 88d6904c7..5a5bf8fad 100644
--- a/docs/narr/testing.rst
+++ b/docs/narr/testing.rst
@@ -214,11 +214,10 @@ function.
 .. code-block:: python
    :linenos:
 
-   from pyramid.security import has_permission
    from pyramid.httpexceptions import HTTPForbidden
 
    def view_fn(request):
-       if not has_permission('edit', request.context, request):
+       if request.has_permission('edit'):
            raise HTTPForbidden
        return {'greeting':'hello'}
 
@@ -229,15 +228,16 @@ function.
    otherwise it would fail when run normally.
 
 Without doing anything special during a unit test, the call to
-:func:`~pyramid.security.has_permission` in this view function will always
-return a ``True`` value.  When a :app:`Pyramid` application starts normally,
-it will populate a :term:`application registry` using :term:`configuration
-declaration` calls made against a :term:`Configurator`.  But if this
-application registry is not created and populated (e.g. by initializing the
-configurator with an authorization policy), like when you invoke application
-code via a unit test, :app:`Pyramid` API functions will tend to either fail
-or return default results.  So how do you test the branch of the code in this
-view function that raises :exc:`~pyramid.httpexceptions.HTTPForbidden`?
+:meth:`~pyramid.request.Request.has_permission` in this view function will
+always return a ``True`` value.  When a :app:`Pyramid` application starts
+normally, it will populate a :term:`application registry` using
+:term:`configuration declaration` calls made against a :term:`Configurator`.
+But if this application registry is not created and populated (e.g. by
+initializing the configurator with an authorization policy), like when you
+invoke application code via a unit test, :app:`Pyramid` API functions will tend
+to either fail or return default results.  So how do you test the branch of the
+code in this view function that raises
+:exc:`~pyramid.httpexceptions.HTTPForbidden`?
 
 The testing API provided by :app:`Pyramid` allows you to simulate various
 application registry registrations for use under a unit testing framework
@@ -287,12 +287,12 @@ Its third line registers a "dummy" "non-permissive" authorization policy
 using the :meth:`~pyramid.config.Configurator.testing_securitypolicy` method,
 which is a special helper method for unit testing.
 
-We then create a :class:`pyramid.testing.DummyRequest` object which simulates
-a WebOb request object API.  A :class:`pyramid.testing.DummyRequest` is a
-request object that requires less setup than a "real" :app:`Pyramid` request.
-We call the function being tested with the manufactured request.  When the
-function is called, :func:`pyramid.security.has_permission` will call the
-"dummy" authentication policy we've registered through
+We then create a :class:`pyramid.testing.DummyRequest` object which simulates a
+WebOb request object API.  A :class:`pyramid.testing.DummyRequest` is a request
+object that requires less setup than a "real" :app:`Pyramid` request.  We call
+the function being tested with the manufactured request.  When the function is
+called, :meth:`pyramid.request.Request.has_permission` will call the "dummy"
+authentication policy we've registered through
 :meth:`~pyramid.config.Configurator.testing_securitypolicy`, which denies
 access.  We check that the view function raises a
 :exc:`~pyramid.httpexceptions.HTTPForbidden` error.
diff --git a/docs/narr/threadlocals.rst b/docs/narr/threadlocals.rst
index a90ee4905..afe56de3e 100644
--- a/docs/narr/threadlocals.rst
+++ b/docs/narr/threadlocals.rst
@@ -29,17 +29,16 @@ of a thread local or a global is usually just a way to avoid passing
 some value around between functions, which is itself usually a very
 bad idea, at least if code readability counts as an important concern.
 
-For historical reasons, however, thread local variables are indeed
-consulted by various :app:`Pyramid` API functions.  For example,
-the implementation of the :mod:`pyramid.security` function named
-:func:`~pyramid.security.authenticated_userid` retrieves the thread
-local :term:`application registry` as a matter of course to find an
+For historical reasons, however, thread local variables are indeed consulted by
+various :app:`Pyramid` API functions.  For example, the implementation of the
+:mod:`pyramid.security` function named
+:func:`~pyramid.security.authenticated_userid` (deprecated as of 1.5) retrieves
+the thread local :term:`application registry` as a matter of course to find an
 :term:`authentication policy`.  It uses the
-:func:`pyramid.threadlocal.get_current_registry` function to
-retrieve the application registry, from which it looks up the
-authentication policy; it then uses the authentication policy to
-retrieve the authenticated user id.  This is how :app:`Pyramid`
-allows arbitrary authentication policies to be "plugged in".
+:func:`pyramid.threadlocal.get_current_registry` function to retrieve the
+application registry, from which it looks up the authentication policy; it then
+uses the authentication policy to retrieve the authenticated user id.  This is
+how :app:`Pyramid` allows arbitrary authentication policies to be "plugged in".
 
 When they need to do so, :app:`Pyramid` internals use two API
 functions to retrieve the :term:`request` and :term:`application
diff --git a/docs/narr/upgrading.rst b/docs/narr/upgrading.rst
index 64343ca3e..eb3194a65 100644
--- a/docs/narr/upgrading.rst
+++ b/docs/narr/upgrading.rst
@@ -137,7 +137,7 @@ In the above case, it's line #3 in the ``myproj.views`` module (``from
 pyramid.view import static``) that is causing the problem:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from pyramid.view import view_config
 
@@ -148,7 +148,7 @@ The deprecation warning tells me how to fix it, so I can change the code to
 do things the newer way:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     from pyramid.view import view_config
 
diff --git a/docs/narr/urldispatch.rst b/docs/narr/urldispatch.rst
index 61849c3c0..96ee5758e 100644
--- a/docs/narr/urldispatch.rst
+++ b/docs/narr/urldispatch.rst
@@ -492,7 +492,7 @@ The simplest route declaration which configures a route match to *directly*
 result in a particular view callable being invoked:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     config.add_route('idea', 'site/{id}')
     config.add_view('mypackage.views.site_view', route_name='idea')
@@ -901,7 +901,7 @@ Details of the route matching decision for a particular request to the
 which you started the application from.  For example:
 
 .. code-block:: text
-   :linenos:
+    :linenos:
 
     $ PYRAMID_DEBUG_ROUTEMATCH=true $VENV/bin/pserve development.ini
     Starting server in PID 13586.
@@ -1060,7 +1060,7 @@ A custom route predicate may also *modify* the ``match`` dictionary.  For
 instance, a predicate might do some type conversion of values:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     def integers(*segment_names):
         def predicate(info, request):
@@ -1086,7 +1086,7 @@ To avoid the try/except uncertainty, the route pattern can contain regular
 expressions specifying requirements for that marker. For instance:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     def integers(*segment_names):
         def predicate(info, request):
@@ -1128,7 +1128,7 @@ name.  The ``pattern`` attribute is the route pattern.  An example of using
 the route in a set of route predicates:
 
 .. code-block:: python
-   :linenos:
+    :linenos:
 
     def twenty_ten(info, request):
         if info['route'].name in ('ymd', 'ym', 'y'):
diff --git a/docs/narr/vhosting.rst b/docs/narr/vhosting.rst
index d37518052..53f6888b3 100644
--- a/docs/narr/vhosting.rst
+++ b/docs/narr/vhosting.rst
@@ -109,7 +109,7 @@ An example of an Apache ``mod_proxy`` configuration that will host the
 is below:
 
 .. code-block:: apache
-   :linenos:
+    :linenos:
 
     NameVirtualHost *:80
 
@@ -130,7 +130,7 @@ For a :app:`Pyramid` application running under :term:`mod_wsgi`,
 the same can be achieved using ``SetEnv``:
 
 .. code-block:: apache
-   :linenos:
+    :linenos:
 
     <Location />
       SetEnv HTTP_X_VHM_ROOT /cms
diff --git a/docs/narr/viewconfig.rst b/docs/narr/viewconfig.rst
index 7c76116f7..e5a2c1ade 100644
--- a/docs/narr/viewconfig.rst
+++ b/docs/narr/viewconfig.rst
@@ -435,7 +435,7 @@ configured view.
 
   If specified, this value should be a :term:`principal` identifier or a
   sequence of principal identifiers.  If the
-  :func:`pyramid.security.effective_principals` method indicates that every
+  :meth:`pyramid.request.Request.effective_principals` method indicates that every
   principal named in the argument list is present in the current request, this
   predicate will return True; otherwise it will return False.  For example:
   ``effective_principals=pyramid.security.Authenticated`` or
diff --git a/docs/narr/views.rst b/docs/narr/views.rst
index b2dd549ce..a746eb043 100644
--- a/docs/narr/views.rst
+++ b/docs/narr/views.rst
@@ -536,7 +536,7 @@ The following types work as view callables in this style:
    e.g.:
 
    .. code-block:: python
-      :linenos:
+       :linenos:
 
        from pyramid.response import Response
 
diff --git a/docs/quick_tour/package/hello_world/__init__.py b/docs/quick_tour/package/hello_world/__init__.py
index 6e66bf40a..4a4fbec30 100644
--- a/docs/quick_tour/package/hello_world/__init__.py
+++ b/docs/quick_tour/package/hello_world/__init__.py
@@ -1,7 +1,7 @@
 from pyramid.config import Configurator
 from pyramid_jinja2 import renderer_factory
 # Start Sphinx Include 1
-from pyramid.session import UnencryptedCookieSessionFactoryConfig
+from pyramid.session import SignedCookieSessionFactory
 # End Sphinx Include 1
 
 from hello_world.models import get_root
@@ -16,7 +16,7 @@ def main(global_config, **settings):
     settings.setdefault('jinja2.i18n.domain', 'hello_world')
 
     # Start Sphinx Include 2
-    my_session_factory = UnencryptedCookieSessionFactoryConfig('itsaseekreet')
+    my_session_factory = SignedCookieSessionFactory('itsaseekreet')
     config = Configurator(root_factory=get_root, settings=settings,
                           session_factory=my_session_factory)
     # End Sphinx Include 2
diff --git a/docs/quick_tour/package/hello_world/init.py b/docs/quick_tour/package/hello_world/init.py
index 9d7ec43d8..5b5f6a118 100644
--- a/docs/quick_tour/package/hello_world/init.py
+++ b/docs/quick_tour/package/hello_world/init.py
@@ -1,7 +1,7 @@
 from pyramid.config import Configurator
 from pyramid_jinja2 import renderer_factory
 # Start Sphinx 1
-from pyramid.session import UnencryptedCookieSessionFactoryConfig
+from pyramid.session import SignedCookieSessionFactory
 # End Sphinx 1
 
 from hello_world.models import get_root
@@ -22,7 +22,7 @@ def main(global_config, **settings):
     # End Include
 
     # Start Sphinx Include 2
-    my_session_factory = UnencryptedCookieSessionFactoryConfig('itsaseekreet')
+    my_session_factory = SignedCookieSessionFactory('itsaseekreet')
     config = Configurator(session_factory=my_session_factory)
     # End Sphinx Include 2
 
diff --git a/docs/quick_tutorial/authentication/tutorial/views.py b/docs/quick_tutorial/authentication/tutorial/views.py
index 3038b6d9b..ab46eb2dd 100644
--- a/docs/quick_tutorial/authentication/tutorial/views.py
+++ b/docs/quick_tutorial/authentication/tutorial/views.py
@@ -2,8 +2,8 @@ from pyramid.httpexceptions import HTTPFound
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid
     )
+
 from pyramid.view import (
     view_config,
     view_defaults
@@ -16,7 +16,7 @@ from .security import USERS
 class TutorialViews:
     def __init__(self, request):
         self.request = request
-        self.logged_in = authenticated_userid(request)
+        self.logged_in = request.authenticated_userid
 
     @view_config(route_name='home')
     def home(self):
diff --git a/docs/quick_tutorial/authorization/tutorial/views.py b/docs/quick_tutorial/authorization/tutorial/views.py
index 92c1946ba..43d14455a 100644
--- a/docs/quick_tutorial/authorization/tutorial/views.py
+++ b/docs/quick_tutorial/authorization/tutorial/views.py
@@ -2,8 +2,8 @@ from pyramid.httpexceptions import HTTPFound
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid
     )
+
 from pyramid.view import (
     view_config,
     view_defaults,
@@ -17,7 +17,7 @@ from .security import USERS
 class TutorialViews:
     def __init__(self, request):
         self.request = request
-        self.logged_in = authenticated_userid(request)
+        self.logged_in = request.authenticated_userid
 
     @view_config(route_name='home')
     def home(self):
diff --git a/docs/quick_tutorial/sessions/tutorial/__init__.py b/docs/quick_tutorial/sessions/tutorial/__init__.py
index ecf57bb32..9ddc2e1b1 100644
--- a/docs/quick_tutorial/sessions/tutorial/__init__.py
+++ b/docs/quick_tutorial/sessions/tutorial/__init__.py
@@ -1,9 +1,9 @@
 from pyramid.config import Configurator
-from pyramid.session import UnencryptedCookieSessionFactoryConfig
+from pyramid.session import SignedCookieSessionFactory
 
 
 def main(global_config, **settings):
-    my_session_factory = UnencryptedCookieSessionFactoryConfig(
+    my_session_factory = SignedCookieSessionFactory(
         'itsaseekreet')
     config = Configurator(settings=settings,
                           session_factory=my_session_factory)
@@ -11,4 +11,4 @@ def main(global_config, **settings):
     config.add_route('home', '/')
     config.add_route('hello', '/howdy')
     config.scan('.views')
-    return config.make_wsgi_app()
\ No newline at end of file
+    return config.make_wsgi_app()
diff --git a/docs/tutorials/wiki/authorization.rst b/docs/tutorials/wiki/authorization.rst
index 460a852e0..93cd0c18e 100644
--- a/docs/tutorials/wiki/authorization.rst
+++ b/docs/tutorials/wiki/authorization.rst
@@ -56,10 +56,10 @@ returns one of these values:
   return ``None``.
 
 For example, ``groupfinder('editor', request )`` returns ``['group:editor']``,
-``groupfinder('viewer', request)`` returns ``[]``, and ``groupfinder('admin', request)``
-returns ``None``.  We will use ``groupfinder()`` as an :term:`authentication policy`
-"callback" that will provide the :term:`principal` or principals
-for a user.
+``groupfinder('viewer', request)`` returns ``[]``, and ``groupfinder('admin',
+request)`` returns ``None``.  We will use ``groupfinder()`` as an
+:term:`authentication policy` "callback" that will provide the
+:term:`principal` or principals for a user.
 
 In a production system, user and group
 data will most often come from a database, but here we use "dummy"
@@ -149,8 +149,8 @@ to the ``@view_config`` decorator for ``add_page()`` and
 ``edit_page()``, for example:
 
 .. code-block:: python
-   :linenos:
-   :emphasize-lines: 3
+    :linenos:
+    :emphasize-lines: 3
 
     @view_config(name='add_page', context='.models.Wiki',
                  renderer='templates/edit.pt',
@@ -251,18 +251,6 @@ in ``views.py``.
 Return a logged_in flag to the renderer
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Add the following line to the import at the head of
-``tutorial/tutorial/views.py``:
-
-.. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 11-15
-   :linenos:
-   :emphasize-lines: 4
-   :language: python
-
-(Only the highlighted line and a trailing comma on the preceding
-line need to be added.)
-
 Add a  ``logged_in`` parameter to the return value of
 ``view_page()``, ``edit_page()`` and  ``add_page()``,
 like this:
@@ -274,14 +262,13 @@ like this:
    return dict(page = page,
                content = content,
                edit_url = edit_url,
-               logged_in = authenticated_userid(request))
+               logged_in = request.authenticated_userid)
 
 (Only the highlighted line and a trailing comma on the preceding
 line need to be added.)
 
-:meth:`~pyramid.security.authenticated_userid()` will return ``None``
-if the user is not authenticated, or a user id if the user is
-authenticated.
+The :meth:`pyramid.request.Request.authenticated_userid` will be ``None`` if
+the user is not authenticated, or a user id if the user is authenticated.
 
 Add a "Logout" link when logged in
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/docs/tutorials/wiki/src/authorization/tutorial/views.py b/docs/tutorials/wiki/src/authorization/tutorial/views.py
index 77956b1e3..62e96e0e7 100644
--- a/docs/tutorials/wiki/src/authorization/tutorial/views.py
+++ b/docs/tutorials/wiki/src/authorization/tutorial/views.py
@@ -11,9 +11,9 @@ from pyramid.view import (
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid,
     )
 
+
 from .security import USERS
 from .models import Page
 
@@ -45,7 +45,7 @@ def view_page(context, request):
     edit_url = request.resource_url(context, 'edit_page')
 
     return dict(page = context, content = content, edit_url = edit_url,
-                logged_in = authenticated_userid(request))
+                logged_in = request.authenticated_userid)
 
 @view_config(name='add_page', context='.models.Wiki',
              renderer='templates/edit.pt',
@@ -65,7 +65,7 @@ def add_page(context, request):
     page.__parent__ = context
 
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(name='edit_page', context='.models.Page',
              renderer='templates/edit.pt',
@@ -77,7 +77,7 @@ def edit_page(context, request):
 
     return dict(page=context,
                 save_url=request.resource_url(context, 'edit_page'),
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(context='.models.Wiki', name='login',
              renderer='templates/login.pt')
diff --git a/docs/tutorials/wiki/src/tests/tutorial/views.py b/docs/tutorials/wiki/src/tests/tutorial/views.py
index 77956b1e3..62e96e0e7 100644
--- a/docs/tutorials/wiki/src/tests/tutorial/views.py
+++ b/docs/tutorials/wiki/src/tests/tutorial/views.py
@@ -11,9 +11,9 @@ from pyramid.view import (
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid,
     )
 
+
 from .security import USERS
 from .models import Page
 
@@ -45,7 +45,7 @@ def view_page(context, request):
     edit_url = request.resource_url(context, 'edit_page')
 
     return dict(page = context, content = content, edit_url = edit_url,
-                logged_in = authenticated_userid(request))
+                logged_in = request.authenticated_userid)
 
 @view_config(name='add_page', context='.models.Wiki',
              renderer='templates/edit.pt',
@@ -65,7 +65,7 @@ def add_page(context, request):
     page.__parent__ = context
 
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(name='edit_page', context='.models.Page',
              renderer='templates/edit.pt',
@@ -77,7 +77,7 @@ def edit_page(context, request):
 
     return dict(page=context,
                 save_url=request.resource_url(context, 'edit_page'),
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(context='.models.Wiki', name='login',
              renderer='templates/login.pt')
diff --git a/docs/tutorials/wiki2/authorization.rst b/docs/tutorials/wiki2/authorization.rst
index cf20db6d7..1e5d0dcbf 100644
--- a/docs/tutorials/wiki2/authorization.rst
+++ b/docs/tutorials/wiki2/authorization.rst
@@ -221,7 +221,7 @@ Add the following import statements to the
 head of ``tutorial/tutorial/views.py``:
 
 .. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 9-16,18,24-25
+   :lines: 9-19
    :linenos:
    :emphasize-lines: 3,6-9,11
    :language: python
@@ -274,17 +274,6 @@ added to ``views.py``.
 Return a logged_in flag to the renderer
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-Add the following line to the import at the head of
-``tutorial/tutorial/views.py``:
-
-.. literalinclude:: src/authorization/tutorial/views.py
-   :lines: 14-18
-   :linenos:
-   :emphasize-lines: 4
-   :language: python
-
-(Only the highlighted line needs to be added.)
-
 Add a  ``logged_in`` parameter to the return value of
 ``view_page()``, ``edit_page()`` and  ``add_page()``,
 like this:
@@ -296,12 +285,12 @@ like this:
    return dict(page = page,
                content = content,
                edit_url = edit_url,
-               logged_in = authenticated_userid(request))
+               logged_in = request.authenticated_userid)
 
 (Only the highlighted line needs to be added.)
 
-The :meth:`~pyramid.security.authenticated_userid` method will return None
-if the user is not authenticated.
+The :meth:`~pyramid.request.Request.authenticated_userid` property will be
+``None`` if the user is not authenticated.
 
 Add a "Logout" link when logged in
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -349,7 +338,7 @@ when we're done:
 
 .. literalinclude:: src/authorization/tutorial/views.py
    :linenos:
-   :emphasize-lines: 11,14-18,25,31,37,58,61,73,76,88,91-117,119-123
+   :emphasize-lines: 11,14-19,25,31,37,58,61,73,76,88,91-117,119-123
    :language: python
 
 (Only the highlighted lines need to be added.)
diff --git a/docs/tutorials/wiki2/src/authorization/tutorial/views.py b/docs/tutorials/wiki2/src/authorization/tutorial/views.py
index b6dbbf5f6..e954d5a31 100644
--- a/docs/tutorials/wiki2/src/authorization/tutorial/views.py
+++ b/docs/tutorials/wiki2/src/authorization/tutorial/views.py
@@ -14,15 +14,15 @@ from pyramid.view import (
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid,
     )
 
+from .security import USERS
+
 from .models import (
     DBSession,
     Page,
     )
 
-from .security import USERS
 
 # regular expression used to find WikiWords
 wikiwords = re.compile(r"\b([A-Z]\w+[A-Z]+\w+)")
@@ -55,7 +55,7 @@ def view_page(request):
     content = wikiwords.sub(check, content)
     edit_url = request.route_url('edit_page', pagename=pagename)
     return dict(page=page, content=content, edit_url=edit_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='add_page', renderer='templates/edit.pt',
              permission='edit')
@@ -70,7 +70,7 @@ def add_page(request):
     save_url = request.route_url('add_page', pagename=pagename)
     page = Page(name='', data='')
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='edit_page', renderer='templates/edit.pt',
              permission='edit')
@@ -84,8 +84,8 @@ def edit_page(request):
                                                       pagename=pagename))
     return dict(
         page=page,
-        save_url = request.route_url('edit_page', pagename=pagename),
-        logged_in=authenticated_userid(request),
+        save_url=request.route_url('edit_page', pagename=pagename),
+        logged_in=request.authenticated_userid
         )
 
 @view_config(route_name='login', renderer='templates/login.pt')
diff --git a/docs/tutorials/wiki2/src/tests/tutorial/tests.py b/docs/tutorials/wiki2/src/tests/tutorial/tests.py
index 4ee30685e..c50e05b6d 100644
--- a/docs/tutorials/wiki2/src/tests/tutorial/tests.py
+++ b/docs/tutorials/wiki2/src/tests/tutorial/tests.py
@@ -26,27 +26,6 @@ def _registerRoutes(config):
     config.add_route('add_page', 'add_page/{pagename}')
 
 
-class PageModelTests(unittest.TestCase):
-
-    def setUp(self):
-        self.session = _initTestingDB()
-
-    def tearDown(self):
-        self.session.remove()
-
-    def _getTargetClass(self):
-        from tutorial.models import Page
-        return Page
-
-    def _makeOne(self, name='SomeName', data='some data'):
-        return self._getTargetClass()(name, data)
-
-    def test_constructor(self):
-        instance = self._makeOne()
-        self.assertEqual(instance.name, 'SomeName')
-        self.assertEqual(instance.data, 'some data')
-
-
 class ViewWikiTests(unittest.TestCase):
     def setUp(self):
         self.config = testing.setUp()
diff --git a/docs/tutorials/wiki2/src/tests/tutorial/views.py b/docs/tutorials/wiki2/src/tests/tutorial/views.py
index b6dbbf5f6..41bea4785 100644
--- a/docs/tutorials/wiki2/src/tests/tutorial/views.py
+++ b/docs/tutorials/wiki2/src/tests/tutorial/views.py
@@ -14,15 +14,15 @@ from pyramid.view import (
 from pyramid.security import (
     remember,
     forget,
-    authenticated_userid,
     )
 
+from .security import USERS
+
 from .models import (
     DBSession,
     Page,
     )
 
-from .security import USERS
 
 # regular expression used to find WikiWords
 wikiwords = re.compile(r"\b([A-Z]\w+[A-Z]+\w+)")
@@ -55,7 +55,7 @@ def view_page(request):
     content = wikiwords.sub(check, content)
     edit_url = request.route_url('edit_page', pagename=pagename)
     return dict(page=page, content=content, edit_url=edit_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='add_page', renderer='templates/edit.pt',
              permission='edit')
@@ -70,7 +70,7 @@ def add_page(request):
     save_url = request.route_url('add_page', pagename=pagename)
     page = Page(name='', data='')
     return dict(page=page, save_url=save_url,
-                logged_in=authenticated_userid(request))
+                logged_in=request.authenticated_userid)
 
 @view_config(route_name='edit_page', renderer='templates/edit.pt',
              permission='edit')
@@ -84,8 +84,8 @@ def edit_page(request):
                                                       pagename=pagename))
     return dict(
         page=page,
-        save_url = request.route_url('edit_page', pagename=pagename),
-        logged_in=authenticated_userid(request),
+        save_url=request.route_url('edit_page', pagename=pagename),
+        logged_in=request.authenticated_userid
         )
 
 @view_config(route_name='login', renderer='templates/login.pt')
@@ -121,4 +121,3 @@ def logout(request):
     headers = forget(request)
     return HTTPFound(location = request.route_url('view_wiki'),
                      headers = headers)
-    
diff --git a/docs/whatsnew-1.5.rst b/docs/whatsnew-1.5.rst
index 57f93cbff..23613896a 100644
--- a/docs/whatsnew-1.5.rst
+++ b/docs/whatsnew-1.5.rst
@@ -316,6 +316,48 @@ The feature additions in Pyramid 1.5 follow.
 - :func:`pyramid.path.package_name` no longer thows an exception when resolving 
   the package name for namespace packages that have no ``__file__`` attribute.
 
+- An authorization API has been added as a method of the request:
+  :meth:`pyramid.request.Request.has_permission`.  It is a method-based
+  alternative to the :func:`pyramid.security.has_permission` API and works
+  exactly the same.  The older API is now deprecated.
+
+- Property API attributes have been added to the request for easier access to
+  authentication data: :attr:`pyramid.request.Request.authenticated_userid`,
+  :attr:`pyramid.request.Request.unauthenticated_userid`, and
+  :attr:`pyramid.request.Request.effective_principals`.  These are analogues,
+  respectively, of :func:`pyramid.security.authenticated_userid`,
+  :func:`pyramid.security.unauthenticated_userid`, and
+  :func:`pyramid.security.effective_principals`.  They operate exactly the
+  same, except they are attributes of the request instead of functions
+  accepting a request.  They are properties, so they cannot be assigned to.
+  The older function-based APIs are now deprecated.
+
+- Pyramid's console scripts (``pserve``, ``pviews``, etc) can now be run
+  directly, allowing custom arguments to be sent to the python interpreter
+  at runtime. For example::
+
+      python -3 -m pyramid.scripts.pserve development.ini
+
+- Added a specific subclass of :class:`pyramid.httpexceptions.HTTPBadRequest`
+  named :class:`pyramid.exceptions.BadCSRFToken` which will now be raised in
+  response to failures in the ``check_csrf_token`` view predicate.  See
+  https://github.com/Pylons/pyramid/pull/1149
+
+- Added a new ``SignedCookieSessionFactory`` which is very similar to the
+  ``UnencryptedCookieSessionFactoryConfig`` but with a clearer focus on
+  signing content. The custom serializer arguments to this function should
+  only focus on serializing, unlike its predecessor which required the
+  serializer to also perform signing.
+  See https://github.com/Pylons/pyramid/pull/1142
+
+- Added a new ``BaseCookieSessionFactory`` which acts as a generic cookie
+  factory that can be used by framework implementors to create their own
+  session implementations. It provides a reusable API which focuses strictly
+  on providing a dictionary-like object that properly handles renewals,
+  timeouts, and conformance with the ``ISession`` API.
+  See https://github.com/Pylons/pyramid/pull/1142
+
+
 Other Backwards Incompatibilities
 ---------------------------------
 
@@ -404,6 +446,13 @@ Other Backwards Incompatibilities
   Pyramid narrative documentation instead of providing renderer globals values
   to the configurator.
 
+- The key/values in the ``_query`` parameter of
+  :meth:`pyramid.request.Request.route_url` and the ``query`` parameter of
+  :meth:`pyramid.request.Request.resource_url` (and their variants), used to
+  encode a value of ``None`` as the string ``'None'``, leaving the resulting
+  query string to be ``a=b&key=None``. The value is now dropped in this
+  situation, leaving a query string of ``a=b&key=``.  See
+  https://github.com/Pylons/pyramid/issues/1119
 
 Deprecations
 ------------
@@ -417,12 +466,36 @@ Deprecations
   a deprecation warning when used.  It had been docs-deprecated in 1.4
   but did not issue a deprecation warning when used.
 
+- :func:`pyramid.security.has_permission` is now deprecated in favor of using
+  :meth:`pyramid.request.Request.has_permission`.
+
+- The :func:`pyramid.security.authenticated_userid`,
+  :func:`pyramid.security.unauthenticated_userid`, and
+  :func:`pyramid.security.effective_principals` functions have been
+  deprecated. Use :attr:`pyramid.request.Request.authenticated_userid`,
+  :attr:`pyramid.request.Request.unauthenticated_userid` and
+  :attr:`pyramid.request.Request.effective_principals` instead.
+
+- Deprecate the ``pyramid.interfaces.ITemplateRenderer`` interface. It was
+  ill-defined and became unused when Mako and Chameleon template bindings were
+  split into their own packages.
+
+- The ``pyramid.session.UnencryptedCookieSessionFactoryConfig`` API has been 
+  deprecated and is superseded by the 
+  ``pyramid.session.SignedCookieSessionFactory``.  Note that while the cookies
+  generated by the ``UnencryptedCookieSessionFactoryConfig``
+  are compatible with cookies generated by old releases, cookies generated by
+  the SignedCookieSessionFactory are not. See 
+  https://github.com/Pylons/pyramid/pull/1142
+
 Documentation Enhancements
 --------------------------
 
 - A new documentation chapter named :ref:`quick_tour` was added.  It describes
   starting out with Pyramid from a high level.
 
+- Added a :ref:`quick_tutorial` to go with the Quick Tour
+
 - Many other enhancements.
 
 
diff --git a/pyramid/authentication.py b/pyramid/authentication.py
index 454ebd4b2..2c301bd29 100644
--- a/pyramid/authentication.py
+++ b/pyramid/authentication.py
@@ -424,7 +424,9 @@ class AuthTktAuthenticationPolicy(CallbackAuthenticationPolicy):
 
     ``secret``
 
-       The secret (a string) used for auth_tkt cookie signing.
+       The secret (a string) used for auth_tkt cookie signing.  This value
+       should be unique across all values provided to Pyramid for various
+       subsystem secrets (see :ref:`admonishment_against_secret_sharing`).
        Required.
 
     ``callback``
@@ -1176,10 +1178,19 @@ class BasicAuthAuthenticationPolicy(CallbackAuthenticationPolicy):
             return None
         if authmeth.lower() != 'basic':
             return None
+
         try:
-            auth = b64decode(auth.strip()).decode('ascii')
+            authbytes = b64decode(auth.strip())
         except (TypeError, binascii.Error): # can't decode
             return None
+
+        # try utf-8 first, then latin-1; see discussion in
+        # https://github.com/Pylons/pyramid/issues/898
+        try:
+            auth = authbytes.decode('utf-8')
+        except UnicodeDecodeError:
+            auth = authbytes.decode('latin-1')
+
         try:
             username, password = auth.split(':', 1)
         except ValueError: # not enough values to unpack
diff --git a/pyramid/config/predicates.py b/pyramid/config/predicates.py
index c8f66e83d..967f2eeee 100644
--- a/pyramid/config/predicates.py
+++ b/pyramid/config/predicates.py
@@ -13,7 +13,6 @@ from pyramid.traversal import (
 from pyramid.urldispatch import _compile_route
 from pyramid.util import object_description
 from pyramid.session import check_csrf_token
-from pyramid.security import effective_principals
 
 from .util import as_sorted_tuple
 
@@ -288,7 +287,7 @@ class EffectivePrincipalsPredicate(object):
     phash = text
 
     def __call__(self, context, request):
-        req_principals = effective_principals(request)
+        req_principals = request.effective_principals
         if is_nonstr_iter(req_principals):
             rpset = set(req_principals)
             if self.val.issubset(rpset):
diff --git a/pyramid/config/routes.py b/pyramid/config/routes.py
index 4de4663a8..4fd207600 100644
--- a/pyramid/config/routes.py
+++ b/pyramid/config/routes.py
@@ -237,10 +237,10 @@ class RoutesConfiguratorMixin(object):
 
           If specified, this value should be a :term:`principal` identifier or
           a sequence of principal identifiers.  If the
-          :func:`pyramid.security.effective_principals` method indicates that
-          every principal named in the argument list is present in the current
-          request, this predicate will return True; otherwise it will return
-          False.  For example:
+          :attr:`pyramid.request.Request.effective_principals` property
+          indicates that every principal named in the argument list is present
+          in the current request, this predicate will return True; otherwise it
+          will return False.  For example:
           ``effective_principals=pyramid.security.Authenticated`` or
           ``effective_principals=('fred', 'group:admins')``.
 
diff --git a/pyramid/config/testing.py b/pyramid/config/testing.py
index 2ab85b1f5..5df726a31 100644
--- a/pyramid/config/testing.py
+++ b/pyramid/config/testing.py
@@ -47,14 +47,14 @@ class TestingConfiguratorMixin(object):
         ``groupids`` argument.  The authentication policy will return
         the userid identifier implied by the ``userid`` argument and
         the group ids implied by the ``groupids`` argument when the
-        :func:`pyramid.security.authenticated_userid` or
-        :func:`pyramid.security.effective_principals` APIs are
+        :attr:`pyramid.request.Request.authenticated_userid` or
+        :attr:`pyramid.request.Request.effective_principals` APIs are
         used.
 
         This function is most useful when testing code that uses
-        the APIs named :func:`pyramid.security.has_permission`,
-        :func:`pyramid.security.authenticated_userid`,
-        :func:`pyramid.security.effective_principals`, and
+        the APIs named :meth:`pyramid.request.Request.has_permission`,
+        :attr:`pyramid.request.Request.authenticated_userid`,
+        :attr:`pyramid.request.Request.effective_principals`, and
         :func:`pyramid.security.principals_allowed_by_permission`.
 
         .. versionadded:: 1.4
diff --git a/pyramid/config/views.py b/pyramid/config/views.py
index 233bbac12..72dc3f414 100644
--- a/pyramid/config/views.py
+++ b/pyramid/config/views.py
@@ -44,6 +44,11 @@ from pyramid.compat import (
     is_nonstr_iter
     )
 
+from pyramid.encode import (
+    quote_plus,
+    urlencode,
+)
+
 from pyramid.exceptions import (
     ConfigurationError,
     PredicateMismatch,
@@ -65,6 +70,8 @@ from pyramid.security import NO_PERMISSION_REQUIRED
 from pyramid.static import static_view
 from pyramid.threadlocal import get_current_registry
 
+from pyramid.url import parse_url_overrides
+
 from pyramid.view import (
     render_view_to_response,
     AppendSlashNotFoundViewFactory,
@@ -1017,10 +1024,10 @@ class ViewsConfiguratorMixin(object):
 
           If specified, this value should be a :term:`principal` identifier or
           a sequence of principal identifiers.  If the
-          :func:`pyramid.security.effective_principals` method indicates that
-          every principal named in the argument list is present in the current
-          request, this predicate will return True; otherwise it will return
-          False.  For example:
+          :attr:`pyramid.request.Request.effective_principals` property
+          indicates that every principal named in the argument list is present
+          in the current request, this predicate will return True; otherwise it
+          will return False.  For example:
           ``effective_principals=pyramid.security.Authenticated`` or
           ``effective_principals=('fred', 'group:admins')``.
 
@@ -1550,6 +1557,7 @@ class ViewsConfiguratorMixin(object):
 
         return deriver(view)
 
+    @viewdefaults
     @action_method
     def add_forbidden_view(
         self,
@@ -1629,6 +1637,7 @@ class ViewsConfiguratorMixin(object):
 
     set_forbidden_view = add_forbidden_view # deprecated sorta-bw-compat alias
     
+    @viewdefaults
     @action_method
     def add_notfound_view(
         self,
@@ -1893,14 +1902,15 @@ class StaticURLInfo(object):
                     kw['subpath'] = subpath
                     return request.route_url(route_name, **kw)
                 else:
+                    app_url, scheme, host, port, qs, anchor = \
+                        parse_url_overrides(kw)
                     parsed = url_parse(url)
                     if not parsed.scheme:
-                        # parsed.scheme is readonly, so we have to parse again
-                        # to change the scheme, sigh.
-                        url = urlparse.urlunparse(url_parse(
-                            url, scheme=request.environ['wsgi.url_scheme']))
+                        url = urlparse.urlunparse(parsed._replace(
+                            scheme=request.environ['wsgi.url_scheme']))
                     subpath = url_quote(subpath)
-                    return urljoin(url, subpath)
+                    result = urljoin(url, subpath)
+                    return result + qs + anchor
 
         raise ValueError('No static URL definition matching %s' % path)
 
diff --git a/pyramid/encode.py b/pyramid/encode.py
index 9e190bc21..0be0107b3 100644
--- a/pyramid/encode.py
+++ b/pyramid/encode.py
@@ -3,11 +3,16 @@ from pyramid.compat import (
     binary_type,
     is_nonstr_iter,
     url_quote as _url_quote,
-    url_quote_plus as quote_plus, # bw compat api (dnr)
+    url_quote_plus as _quote_plus,
     )
 
-def url_quote(s, safe=''): # bw compat api
-    return _url_quote(s, safe=safe)
+def url_quote(val, safe=''): # bw compat api
+    cls = val.__class__
+    if cls is text_type:
+        val = val.encode('utf-8')
+    elif cls is not binary_type:
+        val = str(val).encode('utf-8')
+    return _url_quote(val, safe=safe)
 
 def urlencode(query, doseq=True):
     """
@@ -47,28 +52,28 @@ def urlencode(query, doseq=True):
     prefix = ''
 
     for (k, v) in query:
-        k = _enc(k)
+        k = quote_plus(k)
 
         if is_nonstr_iter(v):
             for x in v:
-                x = _enc(x)
+                x = quote_plus(x)
                 result += '%s%s=%s' % (prefix, k, x)
                 prefix = '&'
         elif v is None:
             result += '%s%s=' % (prefix, k)
         else:
-            v = _enc(v)
+            v = quote_plus(v)
             result += '%s%s=%s' % (prefix, k, v)
 
         prefix = '&'
 
     return result
 
-def _enc(val):
+# bw compat api (dnr)
+def quote_plus(val, safe=''):
     cls = val.__class__
     if cls is text_type:
         val = val.encode('utf-8')
     elif cls is not binary_type:
         val = str(val).encode('utf-8')
-    return quote_plus(val)
-
+    return _quote_plus(val, safe=safe)
diff --git a/pyramid/exceptions.py b/pyramid/exceptions.py
index a8fca1d84..c59d109df 100644
--- a/pyramid/exceptions.py
+++ b/pyramid/exceptions.py
@@ -1,4 +1,5 @@
 from pyramid.httpexceptions import (
+    HTTPBadRequest,
     HTTPNotFound,
     HTTPForbidden,
     )
@@ -8,6 +9,20 @@ Forbidden = HTTPForbidden # bw compat
 
 CR = '\n'
 
+class BadCSRFToken(HTTPBadRequest):
+    """
+    This exception indicates the request has failed cross-site request
+    forgery token validation.
+    """
+    title = 'Bad CSRF Token'
+    explanation = (
+        'Access is denied.  This server can not verify that your cross-site '
+        'request forgery token belongs to your login session.  Either you '
+        'supplied the wrong cross-site request forgery token or your session '
+        'no longer exists.  This may be due to session timeout or because '
+        'browser is not supplying the credentials required, as can happen '
+        'when the browser has cookies turned off.')
+
 class PredicateMismatch(HTTPNotFound):
     """
     This exception is raised by multiviews when no view matches
diff --git a/pyramid/httpexceptions.py b/pyramid/httpexceptions.py
index fff17b2df..ebee39ada 100644
--- a/pyramid/httpexceptions.py
+++ b/pyramid/httpexceptions.py
@@ -565,6 +565,14 @@ class HTTPClientError(HTTPError):
                    'it is either malformed or otherwise incorrect.')
 
 class HTTPBadRequest(HTTPClientError):
+    """
+    subclass of :class:`~HTTPClientError`
+
+    This indicates that the body or headers failed validity checks,
+    preventing the server from being able to continue processing.
+
+    code: 400, title: Bad Request
+    """
     pass
 
 class HTTPUnauthorized(HTTPClientError):
diff --git a/pyramid/i18n.py b/pyramid/i18n.py
index cdedbc877..6ffd93e8f 100644
--- a/pyramid/i18n.py
+++ b/pyramid/i18n.py
@@ -107,7 +107,8 @@ def default_locale_negotiator(request):
 
     - First, the negotiator looks for the ``_LOCALE_`` attribute of
       the request object (possibly set by a view or a listener for an
-      :term:`event`).
+      :term:`event`). If the attribute exists and it is not ``None``,
+      its value will be used.
   
     - Then it looks for the ``request.params['_LOCALE_']`` value.
 
diff --git a/pyramid/interfaces.py b/pyramid/interfaces.py
index 85b2227b4..cf651cf1e 100644
--- a/pyramid/interfaces.py
+++ b/pyramid/interfaces.py
@@ -367,9 +367,29 @@ class IBeforeRender(IDict):
                               '``render`` method for this rendering. '
                               'This feature is new in Pyramid 1.2.')
 
+class IRendererInfo(Interface):
+    """ An object implementing this interface is passed to every
+    :term:`renderer factory` constructor as its only argument (conventionally
+    named ``info``)"""
+    name = Attribute('The value passed by the user as the renderer name')
+    package = Attribute('The "current package" when the renderer '
+                        'configuration statement was found')
+    type = Attribute('The renderer type name')
+    registry = Attribute('The "current" application registry when the '
+                         'renderer was created')
+    settings = Attribute('The deployment settings dictionary related '
+                         'to the current application')
+
+class IRendererFactory(Interface):
+    def __call__(info):
+        """ Return an object that implements
+        :class:`pyramid.interfaces.IRenderer`. ``info`` is an
+        object that implements :class:`pyramid.interfaces.IRendererInfo`.
+        """
+
 class IRenderer(Interface):
     def __call__(value, system):
-        """ Call a the renderer implementation with the result of the
+        """ Call the renderer with the result of the
         view (``value``) passed in and return a result (a string or
         unicode object useful as a response body).  Values computed by
         the system are passed by the system in the ``system``
@@ -387,6 +407,13 @@ class ITemplateRenderer(IRenderer):
         accepts arbitrary keyword arguments and returns a string or
         unicode object """
 
+deprecated(
+    'ITemplateRenderer',
+    'As of Pyramid 1.5 the, "pyramid.interfaces.ITemplateRenderer" interface '
+    'is scheduled to be removed. It was used by the Mako and Chameleon '
+    'renderers which have been split into their own packages.'
+    )
+
 class IViewMapper(Interface):
     def __call__(self, object):
         """ Provided with an arbitrary object (a function, class, or
@@ -611,17 +638,13 @@ class ITraverser(Interface):
 
 ITraverserFactory = ITraverser # b / c for 1.0 code
 
-class IRendererFactory(Interface):
-    def __call__(info):
-        """ Return an object that implements ``IRenderer``.  ``info`` is an
-        object that implement ``IRendererInfo``.  """
-
 class IViewPermission(Interface):
     def __call__(context, request):
-        """ Return True if the permission allows, return False if it denies. """
+        """ Return True if the permission allows, return False if it denies.
+        """
 
 class IRouter(Interface):
-    """WSGI application which routes requests to 'view' code based on
+    """ WSGI application which routes requests to 'view' code based on
     a view registry."""
     registry = Attribute(
         """Component architecture registry local to this application.""")
@@ -932,20 +955,6 @@ class ISession(IDict):
         returned.
         """
 
-class IRendererInfo(Interface):
-    """ An object implementing this interface is passed to every
-    :term:`renderer factory` constructor as its only argument (conventionally
-    named ``info``)"""
-    name = Attribute('The value passed by the user as the renderer name')
-    package = Attribute('The "current package" when the renderer '
-                        'configuration statement was found')
-    type = Attribute('The renderer type name')
-    registry = Attribute('The "current" application registry when the '
-                         'renderer was created')
-    settings = Attribute('The deployment settings dictionary related '
-                         'to the current application')
-
-
 class IIntrospector(Interface):
     def get(category_name, discriminator, default=None):
         """ Get the IIntrospectable related to the category_name and the
diff --git a/pyramid/request.py b/pyramid/request.py
index 2cf0613f7..188e968ac 100644
--- a/pyramid/request.py
+++ b/pyramid/request.py
@@ -21,6 +21,10 @@ from pyramid.compat import (
 from pyramid.decorator import reify
 from pyramid.i18n import LocalizerRequestMixin
 from pyramid.response import Response
+from pyramid.security import (
+    AuthenticationAPIMixin,
+    AuthorizationAPIMixin,
+    )
 from pyramid.url import URLMethodsMixin
 from pyramid.util import InstancePropertyMixin
 
@@ -136,8 +140,15 @@ class CallbackMethodsMixin(object):
             callback(self)
 
 @implementer(IRequest)
-class Request(BaseRequest, URLMethodsMixin, CallbackMethodsMixin,
-              InstancePropertyMixin, LocalizerRequestMixin):
+class Request(
+    BaseRequest,
+    URLMethodsMixin,
+    CallbackMethodsMixin,
+    InstancePropertyMixin,
+    LocalizerRequestMixin,
+    AuthenticationAPIMixin,
+    AuthorizationAPIMixin,
+    ):
     """
     A subclass of the :term:`WebOb` Request class.  An instance of
     this class is created by the :term:`router` and is provided to a
diff --git a/pyramid/scripts/pshell.py b/pyramid/scripts/pshell.py
index dd09bf457..12b078677 100644
--- a/pyramid/scripts/pshell.py
+++ b/pyramid/scripts/pshell.py
@@ -153,16 +153,12 @@ class PShellCommand(object):
         shell = None
         user_shell = self.options.python_shell.lower()
         if not user_shell:
-            shell = self.make_ipython_v0_11_shell()
-            if shell is None:
-                shell = self.make_ipython_v0_10_shell()
+            shell = self.make_ipython_shell()
             if shell is None:
                 shell = self.make_bpython_shell()
 
         elif user_shell == 'ipython':
-            shell = self.make_ipython_v0_11_shell()
-            if shell is None:
-                shell = self.make_ipython_v0_10_shell()
+            shell = self.make_ipython_shell()
 
         elif user_shell == 'bpython':
             shell = self.make_bpython_shell()
@@ -191,6 +187,27 @@ class PShellCommand(object):
             BPShell(locals_=env, banner=help + '\n')
         return shell
 
+    def make_ipython_shell(self):
+        shell = self.make_ipython_v1_1_shell()
+        if shell is None:
+            shell = self.make_ipython_v0_11_shell()
+        if shell is None:
+            shell = self.make_ipython_v0_10_shell()
+        return shell
+
+    def make_ipython_v1_1_shell(self, IPShellFactory=None):
+        if IPShellFactory is None: # pragma: no cover
+            try:
+                from IPython.terminal.embed import (
+                    InteractiveShellEmbed)
+                IPShellFactory = InteractiveShellEmbed
+            except ImportError:
+                return None
+        def shell(env, help):
+            IPShell = IPShellFactory(banner2=help + '\n', user_ns=env)
+            IPShell()
+        return shell
+
     def make_ipython_v0_11_shell(self, IPShellFactory=None):
         if IPShellFactory is None: # pragma: no cover
             try:
diff --git a/pyramid/security.py b/pyramid/security.py
index 3e25f9b2f..58fa9332a 100644
--- a/pyramid/security.py
+++ b/pyramid/security.py
@@ -1,3 +1,4 @@
+from zope.deprecation import deprecated
 from zope.interface import providedBy
 
 from pyramid.interfaces import (
@@ -30,79 +31,143 @@ DENY_ALL = (Deny, Everyone, ALL_PERMISSIONS)
 
 NO_PERMISSION_REQUIRED = '__no_permission_required__'
 
-def has_permission(permission, context, request):
-    """ Provided a permission (a string or unicode object), a context
-    (a :term:`resource` instance) and a request object, return an
-    instance of :data:`pyramid.security.Allowed` if the permission
-    is granted in this context to the user implied by the
-    request. Return an instance of :mod:`pyramid.security.Denied`
-    if this permission is not granted in this context to this user.
-    This function delegates to the current authentication and
-    authorization policies.  Return
-    :data:`pyramid.security.Allowed` unconditionally if no
-    authentication policy has been configured in this application."""
+def _get_registry(request):
     try:
         reg = request.registry
     except AttributeError:
         reg = get_current_registry() # b/c
-    authn_policy = reg.queryUtility(IAuthenticationPolicy)
-    if authn_policy is None:
-        return Allowed('No authentication policy in use.')
+    return reg
 
-    authz_policy = reg.queryUtility(IAuthorizationPolicy)
-    if authz_policy is None:
-        raise ValueError('Authentication policy registered without '
-                         'authorization policy') # should never happen
-    principals = authn_policy.effective_principals(request)
-    return authz_policy.permits(context, principals, permission)
+def _get_authentication_policy(request):
+    registry = _get_registry(request)
+    return registry.queryUtility(IAuthenticationPolicy)
 
-def authenticated_userid(request):
-    """ Return the userid of the currently authenticated user or
-    ``None`` if there is no :term:`authentication policy` in effect or
-    there is no currently authenticated user."""
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
+def has_permission(permission, context, request):
+    """
+    A function that calls
+    :meth:`pyramid.request.Request.has_permission` and returns its result.
+    
+    .. deprecated:: 1.5
+       Use :meth:`pyramid.request.Request.has_permission` instead.
+
+    .. versionchanged:: 1.5a3
+       If context is None, then attempt to use the context attribute
+       of self, if not set then the  AttributeError is propergated.
+    """    
+    return request.has_permission(permission, context)
+
+deprecated(
+    'has_permission',
+    'As of Pyramid 1.5 the "pyramid.security.has_permission" API is now '
+    'deprecated.  It will be removed in Pyramd 1.8.  Use the '
+    '"has_permission" method of the Pyramid request instead.'
+    )
 
-    policy = reg.queryUtility(IAuthenticationPolicy)
-    if policy is None:
-        return None
-    return policy.authenticated_userid(request)
+
+def authenticated_userid(request):
+    """
+    A function that returns the value of the property
+    :attr:`pyramid.request.Request.authenticated_userid`.
+    
+    .. deprecated:: 1.5
+       Use :attr:`pyramid.request.Request.authenticated_userid` instead.
+    """        
+    return request.authenticated_userid
+
+deprecated(
+    'authenticated_userid',
+    'As of Pyramid 1.5 the "pyramid.security.authenticated_userid" API is now '
+    'deprecated.  It will be removed in Pyramd 1.8.  Use the '
+    '"authenticated_userid" attribute of the Pyramid request instead.'
+    )
 
 def unauthenticated_userid(request):
-    """ Return an object which represents the *claimed* (not verified) user
-    id of the credentials present in the request. ``None`` if there is no
-    :term:`authentication policy` in effect or there is no user data
-    associated with the current request.  This differs from
-    :func:`~pyramid.security.authenticated_userid`, because the effective
-    authentication policy will not ensure that a record associated with the
-    userid exists in persistent storage."""
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
+    """ 
+    A function that returns the value of the property
+    :attr:`pyramid.request.Request.unauthenticated_userid`.
+    
+    .. deprecated:: 1.5
+       Use :attr:`pyramid.request.Request.unauthenticated_userid` instead.
+    """        
+    return request.unauthenticated_userid
+
+deprecated(
+    'unauthenticated_userid',
+    'As of Pyramid 1.5 the "pyramid.security.unauthenticated_userid" API is '
+    'now deprecated.  It will be removed in Pyramd 1.8.  Use the '
+    '"unauthenticated_userid" attribute of the Pyramid request instead.'
+    )
+
+def effective_principals(request):
+    """
+    A function that returns the value of the property
+    :attr:`pyramid.request.Request.effective_principals`.
+    
+    .. deprecated:: 1.5
+       Use :attr:`pyramid.request.Request.effective_principals` instead.
+    """            
+    return request.effective_principals
+
+deprecated(
+    'effective_principals',
+    'As of Pyramid 1.5 the "pyramid.security.effective_principals" API is '
+    'now deprecated.  It will be removed in Pyramd 1.8.  Use the '
+    '"effective_principals" attribute of the Pyramid request instead.'
+    )
+
+def remember(request, principal, **kw):
+    """
+    Returns a sequence of header tuples (e.g. ``[('Set-Cookie', 'foo=abc')]``)
+    on this request's response.
+    These headers are suitable for 'remembering' a set of credentials
+    implied by the data passed as ``principal`` and ``*kw`` using the
+    current :term:`authentication policy`.  Common usage might look
+    like so within the body of a view function (``response`` is
+    assumed to be a :term:`WebOb` -style :term:`response` object
+    computed previously by the view code)::
 
-    policy = reg.queryUtility(IAuthenticationPolicy)
+    .. code-block:: python
+
+       from pyramid.security import remember
+       headers = remember(request, 'chrism', password='123', max_age='86400')
+       response = request.response
+       response.headerlist.extend(headers)
+       return response
+
+    If no :term:`authentication policy` is in use, this function will
+    always return an empty sequence. If used, the composition and
+    meaning of ``**kw`` must be agreed upon by the calling code and
+    the effective authentication policy.
+    """
+    policy = _get_authentication_policy(request)
     if policy is None:
-        return None
-    return policy.unauthenticated_userid(request)
+        return []
+    return policy.remember(request, principal, **kw)
 
-def effective_principals(request):
-    """ Return the list of 'effective' :term:`principal` identifiers
-    for the ``request``.  This will include the userid of the
-    currently authenticated user if a user is currently
-    authenticated. If no :term:`authentication policy` is in effect,
-    this will return an empty sequence."""
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
+def forget(request):
+    """
+    Return a sequence of header tuples (e.g. ``[('Set-Cookie',
+    'foo=abc')]``) suitable for 'forgetting' the set of credentials
+    possessed by the currently authenticated user.  A common usage
+    might look like so within the body of a view function
+    (``response`` is assumed to be an :term:`WebOb` -style
+    :term:`response` object computed previously by the view code)::
+
+      from pyramid.security import forget
+      headers = forget(request)
+      response.headerlist.extend(headers)
+      return response
 
-    policy = reg.queryUtility(IAuthenticationPolicy)
+    If no :term:`authentication policy` is in use, this function will
+    always return an empty sequence.
+
+    .. deprecated:: 1.5
+       Use :meth:`pyramid.request.Request.get_logout_headers` instead.
+    """            
+    policy = _get_authentication_policy(request)
     if policy is None:
-        return [Everyone]
-    return policy.effective_principals(request)
+        return []
+    return policy.forget(request)
 
 def principals_allowed_by_permission(context, permission):
     """ Provided a ``context`` (a resource object), and a ``permission``
@@ -140,10 +205,7 @@ def view_execution_permitted(context, request, name=''):
        An exception is raised if no view is found.
 
     """
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
+    reg = _get_registry(request)
     provides = [IViewClassifier] + map_(providedBy, (request, context))
     view = reg.adapters.lookup(provides, ISecuredView, name=name)
     if view is None:
@@ -157,58 +219,6 @@ def view_execution_permitted(context, request, name=''):
             (name, context))
     return view.__permitted__(context, request)
 
-def remember(request, principal, **kw):
-    """ Return a sequence of header tuples (e.g. ``[('Set-Cookie',
-    'foo=abc')]``) suitable for 'remembering' a set of credentials
-    implied by the data passed as ``principal`` and ``*kw`` using the
-    current :term:`authentication policy`.  Common usage might look
-    like so within the body of a view function (``response`` is
-    assumed to be a :term:`WebOb` -style :term:`response` object
-    computed previously by the view code)::
-
-      from pyramid.security import remember
-      headers = remember(request, 'chrism', password='123', max_age='86400')
-      response.headerlist.extend(headers)
-      return response
-
-    If no :term:`authentication policy` is in use, this function will
-    always return an empty sequence.  If used, the composition and
-    meaning of ``**kw`` must be agreed upon by the calling code and
-    the effective authentication policy."""
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
-    policy = reg.queryUtility(IAuthenticationPolicy)
-    if policy is None:
-        return []
-    else:
-        return policy.remember(request, principal, **kw)
-
-def forget(request):
-    """ Return a sequence of header tuples (e.g. ``[('Set-Cookie',
-    'foo=abc')]``) suitable for 'forgetting' the set of credentials
-    possessed by the currently authenticated user.  A common usage
-    might look like so within the body of a view function
-    (``response`` is assumed to be an :term:`WebOb` -style
-    :term:`response` object computed previously by the view code)::
-
-      from pyramid.security import forget
-      headers = forget(request)
-      response.headerlist.extend(headers)
-      return response
-
-    If no :term:`authentication policy` is in use, this function will
-    always return an empty sequence."""
-    try:
-        reg = request.registry
-    except AttributeError:
-        reg = get_current_registry() # b/c
-    policy = reg.queryUtility(IAuthenticationPolicy)
-    if policy is None:
-        return []
-    else:
-        return policy.forget(request)
 
 class PermitsResult(int):
     def __new__(cls, s, *args):
@@ -294,3 +304,89 @@ class ACLAllowed(ACLPermitsResult):
     summary is available as the ``msg`` attribute."""
     boolval = 1
 
+class AuthenticationAPIMixin(object):
+
+    def _get_authentication_policy(self):
+        reg = _get_registry(self)
+        return reg.queryUtility(IAuthenticationPolicy)
+
+    @property
+    def authenticated_userid(self):
+        """ Return the userid of the currently authenticated user or
+        ``None`` if there is no :term:`authentication policy` in effect or
+        there is no currently authenticated user.
+
+        .. versionadded:: 1.5
+        """
+        policy = self._get_authentication_policy()
+        if policy is None:
+            return None
+        return policy.authenticated_userid(self)
+
+    @property
+    def unauthenticated_userid(self):
+        """ Return an object which represents the *claimed* (not verified) user
+        id of the credentials present in the request. ``None`` if there is no
+        :term:`authentication policy` in effect or there is no user data
+        associated with the current request.  This differs from
+        :attr:`~pyramid.request.Request.authenticated_userid`, because the
+        effective authentication policy will not ensure that a record
+        associated with the userid exists in persistent storage.
+
+        .. versionadded:: 1.5
+        """
+        policy = self._get_authentication_policy()
+        if policy is None:
+            return None
+        return policy.unauthenticated_userid(self)
+
+    @property
+    def effective_principals(self):
+        """ Return the list of 'effective' :term:`principal` identifiers
+        for the ``request``.  This will include the userid of the
+        currently authenticated user if a user is currently
+        authenticated. If no :term:`authentication policy` is in effect,
+        this will return an empty sequence.
+
+        .. versionadded:: 1.5
+        """
+        policy = self._get_authentication_policy()
+        if policy is None:
+            return [Everyone]
+        return policy.effective_principals(self)
+    
+class AuthorizationAPIMixin(object):
+
+    def has_permission(self, permission, context=None):
+        """ Given a permission and an optional context, returns an instance of
+        :data:`pyramid.security.Allowed` if the permission is granted to this
+        request with the provided context, or the context already associated
+        with the request.  Otherwise, returns an instance of
+        :data:`pyramid.security.Denied`.  This method delegates to the current
+        authentication and authorization policies.  Returns
+        :data:`pyramid.security.Allowed` unconditionally if no authentication
+        policy has been registered for this request.  If ``context`` is not
+        supplied or is supplied as ``None``, the context used is the
+        ``request.context`` attribute.
+
+        :param permission: Does this request have the given permission?
+        :type permission: unicode, str
+        :param context: A resource object or ``None``
+        :type context: object
+        :returns: `pyramid.security.PermitsResult`
+
+        .. versionadded:: 1.5
+
+        """
+        if context is None:
+            context = self.context
+        reg = _get_registry(self)
+        authn_policy = reg.queryUtility(IAuthenticationPolicy)
+        if authn_policy is None:
+            return Allowed('No authentication policy in use.')
+        authz_policy = reg.queryUtility(IAuthorizationPolicy)
+        if authz_policy is None:
+            raise ValueError('Authentication policy registered without '
+                             'authorization policy') # should never happen
+        principals = authn_policy.effective_principals(self)
+        return authz_policy.permits(context, principals, permission)
diff --git a/pyramid/session.py b/pyramid/session.py
index 3708ef879..d3a4113b9 100644
--- a/pyramid/session.py
+++ b/pyramid/session.py
@@ -1,10 +1,11 @@
-from hashlib import sha1
 import base64
 import binascii
+import hashlib
 import hmac
-import time
 import os
+import time
 
+from zope.deprecation import deprecated
 from zope.interface import implementer
 
 from pyramid.compat import (
@@ -15,25 +16,31 @@ from pyramid.compat import (
     native_,
     )
 
-from pyramid.httpexceptions import HTTPBadRequest
+from pyramid.exceptions import BadCSRFToken
 from pyramid.interfaces import ISession
 from pyramid.util import strings_differ
 
 def manage_accessed(wrapped):
-    """ Decorator which causes a cookie to be set when a wrapped
-    method is called"""
+    """ Decorator which causes a cookie to be renewed when an accessor
+    method is called."""
     def accessed(session, *arg, **kw):
-        session.accessed = int(time.time())
-        if not session._dirty:
-            session._dirty = True
-            def set_cookie_callback(request, response):
-                session._set_cookie(response)
-                session.request = None # explicitly break cycle for gc
-            session.request.add_response_callback(set_cookie_callback)
+        session.accessed = now = int(time.time())
+        if now - session.renewed > session._reissue_time:
+            session.changed()
         return wrapped(session, *arg, **kw)
     accessed.__doc__ = wrapped.__doc__
     return accessed
 
+def manage_changed(wrapped):
+    """ Decorator which causes a cookie to be set when a setter method
+    is called."""
+    def changed(session, *arg, **kw):
+        session.accessed = int(time.time())
+        session.changed()
+        return wrapped(session, *arg, **kw)
+    changed.__doc__ = wrapped.__doc__
+    return changed
+
 def signed_serialize(data, secret):
     """ Serialize any pickleable structure (``data``) and sign it
     using the ``secret`` (must be a string).  Return the
@@ -48,7 +55,7 @@ def signed_serialize(data, secret):
        response.set_cookie('signed_cookie', cookieval)
     """
     pickled = pickle.dumps(data, pickle.HIGHEST_PROTOCOL)
-    sig = hmac.new(bytes_(secret), pickled, sha1).hexdigest()
+    sig = hmac.new(bytes_(secret), pickled, hashlib.sha1).hexdigest()
     return sig + native_(base64.b64encode(pickled))
 
 def signed_deserialize(serialized, secret, hmac=hmac):
@@ -66,13 +73,13 @@ def signed_deserialize(serialized, secret, hmac=hmac):
     """
     # hmac parameterized only for unit tests
     try:
-        input_sig, pickled = (serialized[:40],
+        input_sig, pickled = (bytes_(serialized[:40]),
                               base64.b64decode(bytes_(serialized[40:])))
     except (binascii.Error, TypeError) as e:
         # Badly formed data can make base64 die
         raise ValueError('Badly formed base64 data: %s' % e)
 
-    sig = hmac.new(bytes_(secret), pickled, sha1).hexdigest()
+    sig = bytes_(hmac.new(bytes_(secret), pickled, hashlib.sha1).hexdigest())
 
     # Avoid timing attacks (see
     # http://seb.dbzteam.org/crypto/python-oauth-timing-hmac.pdf)
@@ -95,7 +102,7 @@ def check_csrf_token(request,
     If the value supplied by param or by header doesn't match the value
     supplied by ``request.session.get_csrf_token()``, and ``raises`` is
     ``True``, this function will raise an
-    :exc:`pyramid.httpexceptions.HTTPBadRequest` exception.
+    :exc:`pyramid.exceptions.BadCSRFToken` exception.
     If the check does succeed and ``raises`` is ``False``, this
     function will return ``False``.  If the CSRF check is successful, this
     function will return ``True`` unconditionally.
@@ -108,93 +115,115 @@ def check_csrf_token(request,
     supplied_token = request.params.get(token, request.headers.get(header))
     if supplied_token != request.session.get_csrf_token():
         if raises:
-            raise HTTPBadRequest('incorrect CSRF token')
+            raise BadCSRFToken('check_csrf_token(): Invalid token')
         return False
     return True
 
-def UnencryptedCookieSessionFactoryConfig(
-    secret,
-    timeout=1200,
+def BaseCookieSessionFactory(
+    serialize,
+    deserialize,
     cookie_name='session',
-    cookie_max_age=None,
-    cookie_path='/',
-    cookie_domain=None,
-    cookie_secure=False, 
-    cookie_httponly=False,
-    cookie_on_exception=True,
-    signed_serialize=signed_serialize,
-    signed_deserialize=signed_deserialize,
+    max_age=None,
+    path='/',
+    domain=None,
+    secure=False,
+    httponly=False,
+    timeout=1200,
+    reissue_time=0,
+    set_on_exception=True,
     ):
     """
-    Configure a :term:`session factory` which will provide unencrypted
-    (but signed) cookie-based sessions.  The return value of this
-    function is a :term:`session factory`, which may be provided as
-    the ``session_factory`` argument of a
-    :class:`pyramid.config.Configurator` constructor, or used
-    as the ``session_factory`` argument of the
-    :meth:`pyramid.config.Configurator.set_session_factory`
-    method.
+    .. versionadded:: 1.5
+    
+    Configure a :term:`session factory` which will provide cookie-based
+    sessions.  The return value of this function is a :term:`session factory`,
+    which may be provided as the ``session_factory`` argument of a
+    :class:`pyramid.config.Configurator` constructor, or used as the
+    ``session_factory`` argument of the
+    :meth:`pyramid.config.Configurator.set_session_factory` method.
 
     The session factory returned by this function will create sessions
     which are limited to storing fewer than 4000 bytes of data (as the
     payload must fit into a single cookie).
 
+    .. warning:
+
+       This class provides no protection from tampering and is only intended
+       to be used by framework authors to create their own cookie-based
+       session factories.
+
     Parameters:
 
-    ``secret``
-      A string which is used to sign the cookie.
+    ``serialize``
+      A callable accepting a Python object and returning a bytestring. A
+      ``ValueError`` should be raised for malformed inputs.
 
-    ``timeout``
-      A number of seconds of inactivity before a session times out.
+    ``deserialize``
+      A callable accepting a bytestring and returning a Python object. A
+      ``ValueError`` should be raised for malformed inputs.
 
     ``cookie_name``
-      The name of the cookie used for sessioning.
+      The name of the cookie used for sessioning. Default: ``'session'``.
 
-    ``cookie_max_age``
+    ``max_age``
       The maximum age of the cookie used for sessioning (in seconds).
       Default: ``None`` (browser scope).
 
-    ``cookie_path``
-      The path used for the session cookie.
+    ``path``
+      The path used for the session cookie. Default: ``'/'``.
 
-    ``cookie_domain``
+    ``domain``
       The domain used for the session cookie.  Default: ``None`` (no domain).
 
-    ``cookie_secure``
-      The 'secure' flag of the session cookie.
+    ``secure``
+      The 'secure' flag of the session cookie. Default: ``False``.
 
-    ``cookie_httponly``
-      The 'httpOnly' flag of the session cookie.
+    ``httponly``
+      Hide the cookie from Javascript by setting the 'HttpOnly' flag of the
+      session cookie. Default: ``False``.
 
-    ``cookie_on_exception``
+    ``timeout``
+      A number of seconds of inactivity before a session times out. If
+      ``None`` then the cookie never expires. Default: 1200.
+
+    ``reissue_time``
+      The number of seconds that must pass before the cookie is automatically
+      reissued as the result of a request which accesses the session. The
+      duration is measured as the number of seconds since the last session
+      cookie was issued and 'now'.  If this value is ``0``, a new cookie
+      will be reissued on every request accesses the session. If ``None``
+      then the cookie's lifetime will never be extended.
+
+      A good rule of thumb: if you want auto-expired cookies based on
+      inactivity: set the ``timeout`` value to 1200 (20 mins) and set the
+      ``reissue_time`` value to perhaps a tenth of the ``timeout`` value
+      (120 or 2 mins).  It's nonsensical to set the ``timeout`` value lower
+      than the ``reissue_time`` value, as the ticket will never be reissued.
+      However, such a configuration is not explicitly prevented.
+
+      Default: ``0``.
+
+    ``set_on_exception``
       If ``True``, set a session cookie even if an exception occurs
-      while rendering a view.
+      while rendering a view. Default: ``True``.
 
-    ``signed_serialize``
-      A callable which takes more or less arbitrary Python data structure and
-      a secret and returns a signed serialization in bytes.
-      Default: ``signed_serialize`` (using pickle).
-
-    ``signed_deserialize``
-      A callable which takes a signed and serialized data structure in bytes
-      and a secret and returns the original data structure if the signature
-      is valid. Default: ``signed_deserialize`` (using pickle).
+    .. versionadded: 1.5a3
     """
 
     @implementer(ISession)
-    class UnencryptedCookieSessionFactory(dict):
+    class CookieSession(dict):
         """ Dictionary-like session object """
 
         # configuration parameters
         _cookie_name = cookie_name
-        _cookie_max_age = cookie_max_age
-        _cookie_path = cookie_path
-        _cookie_domain = cookie_domain
-        _cookie_secure = cookie_secure
-        _cookie_httponly = cookie_httponly
-        _cookie_on_exception = cookie_on_exception
-        _secret = secret
+        _cookie_max_age = max_age
+        _cookie_path = path
+        _cookie_domain = domain
+        _cookie_secure = secure
+        _cookie_httponly = httponly
+        _cookie_on_exception = set_on_exception
         _timeout = timeout
+        _reissue_time = reissue_time
 
         # dirty flag
         _dirty = False
@@ -202,33 +231,45 @@ def UnencryptedCookieSessionFactoryConfig(
         def __init__(self, request):
             self.request = request
             now = time.time()
-            created = accessed = now
+            created = renewed = now
             new = True
             value = None
             state = {}
             cookieval = request.cookies.get(self._cookie_name)
             if cookieval is not None:
                 try:
-                    value = signed_deserialize(cookieval, self._secret)
+                    value = deserialize(bytes_(cookieval))
                 except ValueError:
+                    # the cookie failed to deserialize, dropped
                     value = None
 
             if value is not None:
-                accessed, created, state = value
-                new = False
-                if now - accessed > self._timeout:
+                try:
+                    renewed, created, state = value
+                    new = False
+                    if now - renewed > self._timeout:
+                        # expire the session because it was not renewed
+                        # before the timeout threshold
+                        state = {}
+                except TypeError:
+                    # value failed to unpack properly or renewed was not
+                    # a numeric type so we'll fail deserialization here
                     state = {}
 
             self.created = created
-            self.accessed = accessed
+            self.accessed = renewed
+            self.renewed = renewed
             self.new = new
             dict.__init__(self, state)
 
         # ISession methods
         def changed(self):
-            """ This is intentionally a noop; the session is
-            serialized on every access, so unnecessary"""
-            pass
+            if not self._dirty:
+                self._dirty = True
+                def set_cookie_callback(request, response):
+                    self._set_cookie(response)
+                    self.request = None # explicitly break cycle for gc
+                self.request.add_response_callback(set_cookie_callback)
 
         def invalidate(self):
             self.clear() # XXX probably needs to unset cookie
@@ -250,22 +291,22 @@ def UnencryptedCookieSessionFactoryConfig(
             has_key = manage_accessed(dict.has_key)
 
         # modifying dictionary methods
-        clear = manage_accessed(dict.clear)
-        update = manage_accessed(dict.update)
-        setdefault = manage_accessed(dict.setdefault)
-        pop = manage_accessed(dict.pop)
-        popitem = manage_accessed(dict.popitem)
-        __setitem__ = manage_accessed(dict.__setitem__)
-        __delitem__ = manage_accessed(dict.__delitem__)
+        clear = manage_changed(dict.clear)
+        update = manage_changed(dict.update)
+        setdefault = manage_changed(dict.setdefault)
+        pop = manage_changed(dict.pop)
+        popitem = manage_changed(dict.popitem)
+        __setitem__ = manage_changed(dict.__setitem__)
+        __delitem__ = manage_changed(dict.__delitem__)
 
         # flash API methods
-        @manage_accessed
+        @manage_changed
         def flash(self, msg, queue='', allow_duplicate=True):
             storage = self.setdefault('_f_' + queue, [])
             if allow_duplicate or (msg not in storage):
                 storage.append(msg)
 
-        @manage_accessed
+        @manage_changed
         def pop_flash(self, queue=''):
             storage = self.pop('_f_' + queue, [])
             return storage
@@ -276,7 +317,7 @@ def UnencryptedCookieSessionFactoryConfig(
             return storage
 
         # CSRF API methods
-        @manage_accessed
+        @manage_changed
         def new_csrf_token(self):
             token = text_(binascii.hexlify(os.urandom(20)))
             self['_csrft_'] = token
@@ -295,9 +336,9 @@ def UnencryptedCookieSessionFactoryConfig(
                 exception = getattr(self.request, 'exception', None)
                 if exception is not None: # dont set a cookie during exceptions
                     return False
-            cookieval = signed_serialize(
-                (self.accessed, self.created, dict(self)), self._secret
-                )
+            cookieval = native_(serialize(
+                (self.accessed, self.created, dict(self))
+                ))
             if len(cookieval) > 4064:
                 raise ValueError(
                     'Cookie value is too long to store (%s bytes)' %
@@ -306,12 +347,259 @@ def UnencryptedCookieSessionFactoryConfig(
             response.set_cookie(
                 self._cookie_name,
                 value=cookieval,
-                max_age = self._cookie_max_age,
-                path = self._cookie_path,
-                domain = self._cookie_domain,
-                secure = self._cookie_secure,
-                httponly = self._cookie_httponly,
+                max_age=self._cookie_max_age,
+                path=self._cookie_path,
+                domain=self._cookie_domain,
+                secure=self._cookie_secure,
+                httponly=self._cookie_httponly,
                 )
             return True
 
-    return UnencryptedCookieSessionFactory
+    return CookieSession
+
+
+def UnencryptedCookieSessionFactoryConfig(
+    secret,
+    timeout=1200,
+    cookie_name='session',
+    cookie_max_age=None,
+    cookie_path='/',
+    cookie_domain=None,
+    cookie_secure=False,
+    cookie_httponly=False,
+    cookie_on_exception=True,
+    signed_serialize=signed_serialize,
+    signed_deserialize=signed_deserialize,
+    ):
+    """
+    .. deprecated:: 1.5
+       Use :func:`pyramid.session.SignedCookieSessionFactory` instead.
+    
+    Configure a :term:`session factory` which will provide unencrypted
+    (but signed) cookie-based sessions.  The return value of this
+    function is a :term:`session factory`, which may be provided as
+    the ``session_factory`` argument of a
+    :class:`pyramid.config.Configurator` constructor, or used
+    as the ``session_factory`` argument of the
+    :meth:`pyramid.config.Configurator.set_session_factory`
+    method.
+
+    The session factory returned by this function will create sessions
+    which are limited to storing fewer than 4000 bytes of data (as the
+    payload must fit into a single cookie).
+
+    Parameters:
+
+    ``secret``
+      A string which is used to sign the cookie.
+
+    ``timeout``
+      A number of seconds of inactivity before a session times out.
+
+    ``cookie_name``
+      The name of the cookie used for sessioning.
+
+    ``cookie_max_age``
+      The maximum age of the cookie used for sessioning (in seconds).
+      Default: ``None`` (browser scope).
+
+    ``cookie_path``
+      The path used for the session cookie.
+
+    ``cookie_domain``
+      The domain used for the session cookie.  Default: ``None`` (no domain).
+
+    ``cookie_secure``
+      The 'secure' flag of the session cookie.
+
+    ``cookie_httponly``
+      The 'httpOnly' flag of the session cookie.
+
+    ``cookie_on_exception``
+      If ``True``, set a session cookie even if an exception occurs
+      while rendering a view.
+
+    ``signed_serialize``
+      A callable which takes more or less arbitrary Python data structure and
+      a secret and returns a signed serialization in bytes.
+      Default: ``signed_serialize`` (using pickle).
+
+    ``signed_deserialize``
+      A callable which takes a signed and serialized data structure in bytes
+      and a secret and returns the original data structure if the signature
+      is valid. Default: ``signed_deserialize`` (using pickle).
+    """
+
+    return BaseCookieSessionFactory(
+        lambda v: signed_serialize(v, secret),
+        lambda v: signed_deserialize(v, secret),
+        cookie_name=cookie_name,
+        max_age=cookie_max_age,
+        path=cookie_path,
+        domain=cookie_domain,
+        secure=cookie_secure,
+        httponly=cookie_httponly,
+        timeout=timeout,
+        reissue_time=0, # to keep session.accessed == session.renewed
+        set_on_exception=cookie_on_exception,
+    )
+
+deprecated(
+    'UnencryptedCookieSessionFactoryConfig',
+    'The UnencryptedCookieSessionFactoryConfig callable is deprecated as of '
+    'Pyramid 1.5.  Use ``pyramid.session.SignedCookieSessionFactory`` instead.'
+    )
+
+def SignedCookieSessionFactory(
+    secret,
+    cookie_name='session',
+    max_age=None,
+    path='/',
+    domain=None,
+    secure=False,
+    httponly=False,
+    set_on_exception=True,
+    timeout=1200,
+    reissue_time=0,
+    hashalg='sha512',
+    salt='pyramid.session.',
+    serialize=None,
+    deserialize=None,
+    ):
+    """
+    .. versionadded:: 1.5
+    
+    Configure a :term:`session factory` which will provide signed
+    cookie-based sessions.  The return value of this
+    function is a :term:`session factory`, which may be provided as
+    the ``session_factory`` argument of a
+    :class:`pyramid.config.Configurator` constructor, or used
+    as the ``session_factory`` argument of the
+    :meth:`pyramid.config.Configurator.set_session_factory`
+    method.
+
+    The session factory returned by this function will create sessions
+    which are limited to storing fewer than 4000 bytes of data (as the
+    payload must fit into a single cookie).
+
+    Parameters:
+
+    ``secret``
+      A string which is used to sign the cookie. The secret should be at
+      least as long as the block size of the selected hash algorithm. For
+      ``sha512`` this would mean a 128 bit (64 character) secret.  It should
+      be unique within the set of secret values provided to Pyramid for
+      its various subsystems (see :ref:`admonishment_against_secret_sharing`).
+
+    ``hashalg``
+      The HMAC digest algorithm to use for signing. The algorithm must be
+      supported by the :mod:`hashlib` library. Default: ``'sha512'``.
+
+    ``salt``
+      A namespace to avoid collisions between different uses of a shared
+      secret. Reusing a secret for different parts of an application is
+      strongly discouraged (see :ref:`admonishment_against_secret_sharing`).
+      Default: ``'pyramid.session.'``.
+
+    ``cookie_name``
+      The name of the cookie used for sessioning. Default: ``'session'``.
+
+    ``max_age``
+      The maximum age of the cookie used for sessioning (in seconds).
+      Default: ``None`` (browser scope).
+
+    ``path``
+      The path used for the session cookie. Default: ``'/'``.
+
+    ``domain``
+      The domain used for the session cookie.  Default: ``None`` (no domain).
+
+    ``secure``
+      The 'secure' flag of the session cookie. Default: ``False``.
+
+    ``httponly``
+      Hide the cookie from Javascript by setting the 'HttpOnly' flag of the
+      session cookie. Default: ``False``.
+
+    ``timeout``
+      A number of seconds of inactivity before a session times out. If
+      ``None`` then the cookie never expires. Default: 1200.
+
+    ``reissue_time``
+      The number of seconds that must pass before the cookie is automatically
+      reissued as the result of a request which accesses the session. The
+      duration is measured as the number of seconds since the last session
+      cookie was issued and 'now'.  If this value is ``0``, a new cookie
+      will be reissued on every request accesses the session. If ``None``
+      then the cookie's lifetime will never be extended.
+
+      A good rule of thumb: if you want auto-expired cookies based on
+      inactivity: set the ``timeout`` value to 1200 (20 mins) and set the
+      ``reissue_time`` value to perhaps a tenth of the ``timeout`` value
+      (120 or 2 mins).  It's nonsensical to set the ``timeout`` value lower
+      than the ``reissue_time`` value, as the ticket will never be reissued.
+      However, such a configuration is not explicitly prevented.
+
+      Default: ``0``.
+
+    ``set_on_exception``
+      If ``True``, set a session cookie even if an exception occurs
+      while rendering a view. Default: ``True``.
+
+    ``serialize``
+      A callable accepting a Python object and returning a bytestring. A
+      ``ValueError`` should be raised for malformed inputs.
+      Default: :func:`pickle.dumps`.
+
+    ``deserialize``
+      A callable accepting a bytestring and returning a Python object. A
+      ``ValueError`` should be raised for malformed inputs.
+      Default: :func:`pickle.loads`.
+
+    .. versionadded: 1.5a3
+    """
+
+    if serialize is None:
+        serialize = lambda v: pickle.dumps(v, pickle.HIGHEST_PROTOCOL)
+
+    if deserialize is None:
+        deserialize = pickle.loads
+
+    digestmod = lambda string=b'': hashlib.new(hashalg, string)
+    digest_size = digestmod().digest_size
+
+    salted_secret = bytes_(salt or '') + bytes_(secret)
+
+    def signed_serialize(appstruct):
+        cstruct = serialize(appstruct)
+        sig = hmac.new(salted_secret, cstruct, digestmod).digest()
+        return base64.b64encode(cstruct + sig)
+
+    def signed_deserialize(bstruct):
+        try:
+            fstruct = base64.b64decode(bstruct)
+        except (binascii.Error, TypeError) as e:
+            raise ValueError('Badly formed base64 data: %s' % e)
+
+        cstruct = fstruct[:-digest_size]
+        expected_sig = fstruct[-digest_size:]
+
+        sig = hmac.new(salted_secret, cstruct, digestmod).digest()
+        if strings_differ(sig, expected_sig):
+            raise ValueError('Invalid signature')
+
+        return deserialize(cstruct)
+
+    return BaseCookieSessionFactory(
+        signed_serialize,
+        signed_deserialize,
+        cookie_name=cookie_name,
+        max_age=max_age,
+        path=path,
+        domain=domain,
+        secure=secure,
+        httponly=httponly,
+        timeout=timeout,
+        reissue_time=reissue_time,
+        set_on_exception=set_on_exception,
+    )
diff --git a/pyramid/testing.py b/pyramid/testing.py
index 4590c55f8..b3460d8aa 100644
--- a/pyramid/testing.py
+++ b/pyramid/testing.py
@@ -27,6 +27,8 @@ from pyramid.registry import Registry
 from pyramid.security import (
     Authenticated,
     Everyone,
+    AuthenticationAPIMixin,
+    AuthorizationAPIMixin,
     )
 
 from pyramid.threadlocal import (
@@ -280,10 +282,15 @@ class DummySession(dict):
             token = self.new_csrf_token()
         return token
 
-        
 @implementer(IRequest)
-class DummyRequest(URLMethodsMixin, CallbackMethodsMixin, InstancePropertyMixin,
-                   LocalizerRequestMixin):
+class DummyRequest(
+    URLMethodsMixin,
+    CallbackMethodsMixin,
+    InstancePropertyMixin,
+    LocalizerRequestMixin,
+    AuthenticationAPIMixin,
+    AuthorizationAPIMixin,
+    ):
     """ A DummyRequest object (incompletely) imitates a :term:`request` object.
 
     The ``params``, ``environ``, ``headers``, ``path``, and
diff --git a/pyramid/tests/test_authentication.py b/pyramid/tests/test_authentication.py
index 6e9e3920d..3ac8f2d61 100644
--- a/pyramid/tests/test_authentication.py
+++ b/pyramid/tests/test_authentication.py
@@ -1374,6 +1374,32 @@ class TestBasicAuthAuthenticationPolicy(unittest.TestCase):
         policy = self._makeOne(check)
         self.assertEqual(policy.authenticated_userid(request), 'chrisr')
 
+    def test_authenticated_userid_utf8(self):
+        import base64
+        request = testing.DummyRequest()
+        inputs = (b'm\xc3\xb6rk\xc3\xb6:'
+                  b'm\xc3\xb6rk\xc3\xb6password').decode('utf-8')
+        request.headers['Authorization'] = 'Basic %s' % (
+            base64.b64encode(inputs.encode('utf-8')).decode('latin-1'))
+        def check(username, password, request):
+            return []
+        policy = self._makeOne(check)
+        self.assertEqual(policy.authenticated_userid(request),
+                         b'm\xc3\xb6rk\xc3\xb6'.decode('utf-8'))
+
+    def test_authenticated_userid_latin1(self):
+        import base64
+        request = testing.DummyRequest()
+        inputs = (b'm\xc3\xb6rk\xc3\xb6:'
+                  b'm\xc3\xb6rk\xc3\xb6password').decode('utf-8')
+        request.headers['Authorization'] = 'Basic %s' % (
+            base64.b64encode(inputs.encode('latin-1')).decode('latin-1'))
+        def check(username, password, request):
+            return []
+        policy = self._makeOne(check)
+        self.assertEqual(policy.authenticated_userid(request),
+                         b'm\xc3\xb6rk\xc3\xb6'.decode('utf-8'))
+
     def test_unauthenticated_userid_invalid_payload(self):
         import base64
         request = testing.DummyRequest()
diff --git a/pyramid/tests/test_config/test_testing.py b/pyramid/tests/test_config/test_testing.py
index 1089f09fc..05561bfe9 100644
--- a/pyramid/tests/test_config/test_testing.py
+++ b/pyramid/tests/test_config/test_testing.py
@@ -1,6 +1,7 @@
 import unittest
 
 from pyramid.compat import text_
+from pyramid.security import AuthenticationAPIMixin, AuthorizationAPIMixin
 from pyramid.tests.test_config import IDummy
 
 class TestingConfiguratorMixinTests(unittest.TestCase):
@@ -196,13 +197,9 @@ from zope.interface import implementer
 class DummyEvent:
     pass
 
-class DummyRequest:
-    subpath = ()
-    matchdict = None
+class DummyRequest(AuthenticationAPIMixin, AuthorizationAPIMixin):
     def __init__(self, environ=None):
         if environ is None:
             environ = {}
         self.environ = environ
-        self.params = {}
-        self.cookies = {}
-
+        
diff --git a/pyramid/tests/test_config/test_views.py b/pyramid/tests/test_config/test_views.py
index be2865d30..57bb5e9d0 100644
--- a/pyramid/tests/test_config/test_views.py
+++ b/pyramid/tests/test_config/test_views.py
@@ -40,9 +40,6 @@ class TestViewsConfigurationMixin(unittest.TestCase):
 
     def _registerRenderer(self, config, name='.txt'):
         from pyramid.interfaces import IRendererFactory
-        from pyramid.interfaces import ITemplateRenderer
-        from zope.interface import implementer
-        @implementer(ITemplateRenderer)
         class Renderer:
             def __init__(self, info):
                 self.__class__.info = info
@@ -1818,6 +1815,36 @@ class TestViewsConfigurationMixin(unittest.TestCase):
         self.assertRaises(ConfigurationError,
                           config.add_forbidden_view, http_cache='foo')
 
+    def test_add_forbidden_view_with_view_defaults(self):
+        from pyramid.interfaces import IRequest
+        from pyramid.renderers import null_renderer
+        from pyramid.exceptions import PredicateMismatch
+        from pyramid.httpexceptions import HTTPForbidden
+        from zope.interface import directlyProvides
+        from zope.interface import implementedBy
+        class view(object):
+            __view_defaults__ = {
+                'containment':'pyramid.tests.test_config.IDummy'
+                }
+            def __init__(self, request):
+                pass
+            def __call__(self):
+                return 'OK'
+        config = self._makeOne(autocommit=True)
+        config.add_forbidden_view(
+            view=view,
+            renderer=null_renderer)
+        wrapper = self._getViewCallable(
+            config, ctx_iface=implementedBy(HTTPForbidden),
+            request_iface=IRequest)
+        context = DummyContext()
+        directlyProvides(context, IDummy)
+        request = self._makeRequest(config)
+        self.assertEqual(wrapper(context, request), 'OK')
+        context = DummyContext()
+        request = self._makeRequest(config)
+        self.assertRaises(PredicateMismatch, wrapper, context, request)
+
     def test_add_notfound_view(self):
         from pyramid.renderers import null_renderer
         from zope.interface import implementedBy
@@ -1885,6 +1912,36 @@ class TestViewsConfigurationMixin(unittest.TestCase):
         result = view(None, request)
         self.assertEqual(result.location, '/scriptname/foo/?a=1&b=2')
 
+    def test_add_notfound_view_with_view_defaults(self):
+        from pyramid.interfaces import IRequest
+        from pyramid.renderers import null_renderer
+        from pyramid.exceptions import PredicateMismatch
+        from pyramid.httpexceptions import HTTPNotFound
+        from zope.interface import directlyProvides
+        from zope.interface import implementedBy
+        class view(object):
+            __view_defaults__ = {
+                'containment':'pyramid.tests.test_config.IDummy'
+                }
+            def __init__(self, request):
+                pass
+            def __call__(self):
+                return 'OK'
+        config = self._makeOne(autocommit=True)
+        config.add_notfound_view(
+            view=view,
+            renderer=null_renderer)
+        wrapper = self._getViewCallable(
+            config, ctx_iface=implementedBy(HTTPNotFound),
+            request_iface=IRequest)
+        context = DummyContext()
+        directlyProvides(context, IDummy)
+        request = self._makeRequest(config)
+        self.assertEqual(wrapper(context, request), 'OK')
+        context = DummyContext()
+        request = self._makeRequest(config)
+        self.assertRaises(PredicateMismatch, wrapper, context, request)
+
     # Since Python 3 has to be all cool and fancy and different...
     def _assertBody(self, response, value):
         from pyramid.compat import text_type
@@ -3763,6 +3820,27 @@ class TestStaticURLInfo(unittest.TestCase):
         result = inst.generate('package:path/abc def', request, a=1)
         self.assertEqual(result, 'http://example.com/abc%20def')
 
+    def test_generate_url_with_custom_query(self):
+        inst = self._makeOne()
+        registrations = [('http://example.com/', 'package:path/', None)]
+        inst._get_registrations = lambda *x: registrations
+        request = self._makeRequest()
+        result = inst.generate('package:path/abc def', request, a=1,
+                               _query='(openlayers)')
+        self.assertEqual(result,
+                         'http://example.com/abc%20def?(openlayers)')
+
+    def test_generate_url_with_custom_anchor(self):
+        inst = self._makeOne()
+        registrations = [('http://example.com/', 'package:path/', None)]
+        inst._get_registrations = lambda *x: registrations
+        request = self._makeRequest()
+        uc = text_(b'La Pe\xc3\xb1a', 'utf-8')
+        result = inst.generate('package:path/abc def', request, a=1,
+                               _anchor=uc)
+        self.assertEqual(result,
+                         'http://example.com/abc%20def#La%20Pe%C3%B1a')
+
     def test_add_already_exists(self):
         inst = self._makeOne()
         config = self._makeConfig(
diff --git a/pyramid/tests/test_encode.py b/pyramid/tests/test_encode.py
index 908249877..8fb766d88 100644
--- a/pyramid/tests/test_encode.py
+++ b/pyramid/tests/test_encode.py
@@ -72,3 +72,8 @@ class URLQuoteTests(unittest.TestCase):
         la = b'La/Pe\xc3\xb1a'
         result = self._callFUT(la, '/')
         self.assertEqual(result, 'La/Pe%C3%B1a')
+
+    def test_it_with_nonstr_nonbinary(self):
+        la = None
+        result = self._callFUT(la, '/')
+        self.assertEqual(result, 'None')
diff --git a/pyramid/tests/test_exceptions.py b/pyramid/tests/test_exceptions.py
index aa5ebb376..993209046 100644
--- a/pyramid/tests/test_exceptions.py
+++ b/pyramid/tests/test_exceptions.py
@@ -11,6 +11,12 @@ class TestBWCompat(unittest.TestCase):
         from pyramid.httpexceptions import HTTPForbidden as two
         self.assertTrue(one is two)
 
+class TestBadCSRFToken(unittest.TestCase):
+    def test_response_equivalence(self):
+        from pyramid.exceptions import BadCSRFToken
+        from pyramid.httpexceptions import HTTPBadRequest
+        self.assertTrue(isinstance(BadCSRFToken(), HTTPBadRequest))
+
 class TestNotFound(unittest.TestCase):
     def _makeOne(self, message):
         from pyramid.exceptions import NotFound
diff --git a/pyramid/tests/test_request.py b/pyramid/tests/test_request.py
index 6cd72fc59..ed41b62ff 100644
--- a/pyramid/tests/test_request.py
+++ b/pyramid/tests/test_request.py
@@ -6,9 +6,10 @@ from pyramid.compat import (
     text_,
     bytes_,
     native_,
-    iteritems_,
-    iterkeys_,
-    itervalues_,
+    )
+from pyramid.security import (
+    AuthenticationAPIMixin,
+    AuthorizationAPIMixin,
     )
 
 class TestRequest(unittest.TestCase):
@@ -53,6 +54,11 @@ class TestRequest(unittest.TestCase):
         cls = self._getTargetClass()
         self.assertEqual(cls.ResponseClass, Response)
 
+    def test_implements_security_apis(self):
+        apis = (AuthenticationAPIMixin, AuthorizationAPIMixin)
+        r = self._makeOne()
+        self.assertTrue(isinstance(r, apis))
+
     def test_charset_defaults_to_utf8(self):
         r = self._makeOne({'PATH_INFO':'/'})
         self.assertEqual(r.charset, 'UTF-8')
diff --git a/pyramid/tests/test_scripts/test_pshell.py b/pyramid/tests/test_scripts/test_pshell.py
index 8f9f3abfb..7cb130c41 100644
--- a/pyramid/tests/test_scripts/test_pshell.py
+++ b/pyramid/tests/test_scripts/test_pshell.py
@@ -42,6 +42,15 @@ class TestPShellCommand(unittest.TestCase):
         self.assertEqual(bpython.locals_, {'foo': 'bar'})
         self.assertTrue('a help message' in bpython.banner)
 
+    def test_make_ipython_v1_1_shell(self):
+        command = self._makeOne()
+        ipshell_factory = dummy.DummyIPShellFactory()
+        shell = command.make_ipython_v1_1_shell(ipshell_factory)
+        shell({'foo': 'bar'}, 'a help message')
+        self.assertEqual(ipshell_factory.kw['user_ns'], {'foo': 'bar'})
+        self.assertTrue('a help message' in ipshell_factory.kw['banner2'])
+        self.assertTrue(ipshell_factory.shell.called)
+
     def test_make_ipython_v0_11_shell(self):
         command = self._makeOne()
         ipshell_factory = dummy.DummyIPShellFactory()
@@ -64,8 +73,7 @@ class TestPShellCommand(unittest.TestCase):
     def test_command_loads_default_shell(self):
         command = self._makeOne()
         shell = dummy.DummyShell()
-        command.make_ipython_v0_11_shell = lambda: None
-        command.make_ipython_v0_10_shell = lambda: None
+        command.make_ipython_shell = lambda: None
         command.make_bpython_shell = lambda: None
         command.make_default_shell = lambda: shell
         command.run()
@@ -86,8 +94,7 @@ class TestPShellCommand(unittest.TestCase):
         command = self._makeOne()
         shell = dummy.DummyShell()
         bad_shell = dummy.DummyShell()
-        command.make_ipython_v0_11_shell = lambda: bad_shell
-        command.make_ipython_v0_10_shell = lambda: bad_shell
+        command.make_ipython_shell = lambda: bad_shell
         command.make_bpython_shell = lambda: bad_shell
         command.make_default_shell = lambda: shell
         command.options.python_shell = 'unknow_python_shell'
@@ -106,9 +113,33 @@ class TestPShellCommand(unittest.TestCase):
         self.assertTrue(self.bootstrap.closer.called)
         self.assertTrue(shell.help)
 
+    def test_command_loads_ipython_v1_1(self):
+        command = self._makeOne()
+        shell = dummy.DummyShell()
+        command.make_ipython_v1_1_shell = lambda: shell
+        command.make_ipython_v0_11_shell = lambda: None
+        command.make_ipython_v0_10_shell = lambda: None
+        command.make_bpython_shell = lambda: None
+        command.make_default_shell = lambda: None
+        command.options.python_shell = 'ipython'
+        command.run()
+        self.assertTrue(self.config_factory.parser)
+        self.assertEqual(self.config_factory.parser.filename,
+                         '/foo/bar/myapp.ini')
+        self.assertEqual(self.bootstrap.a[0], '/foo/bar/myapp.ini#myapp')
+        self.assertEqual(shell.env, {
+            'app':self.bootstrap.app, 'root':self.bootstrap.root,
+            'registry':self.bootstrap.registry,
+            'request':self.bootstrap.request,
+            'root_factory':self.bootstrap.root_factory,
+        })
+        self.assertTrue(self.bootstrap.closer.called)
+        self.assertTrue(shell.help)
+
     def test_command_loads_ipython_v0_11(self):
         command = self._makeOne()
         shell = dummy.DummyShell()
+        command.make_ipython_v1_1_shell = lambda: None
         command.make_ipython_v0_11_shell = lambda: shell
         command.make_ipython_v0_10_shell = lambda: None
         command.make_bpython_shell = lambda: None
@@ -131,6 +162,7 @@ class TestPShellCommand(unittest.TestCase):
     def test_command_loads_ipython_v0_10(self):
         command = self._makeOne()
         shell = dummy.DummyShell()
+        command.make_ipython_v1_1_shell = lambda: None
         command.make_ipython_v0_11_shell = lambda: None
         command.make_ipython_v0_10_shell = lambda: shell
         command.make_bpython_shell = lambda: None
@@ -153,8 +185,7 @@ class TestPShellCommand(unittest.TestCase):
     def test_command_loads_bpython_shell(self):
         command = self._makeOne()
         shell = dummy.DummyBPythonShell()
-        command.make_ipython_v0_11_shell = lambda: None
-        command.make_ipython_v0_10_shell = lambda: None
+        command.make_ipython_shell = lambda: None
         command.make_bpython_shell = lambda: shell
         command.options.python_shell = 'bpython'
         command.run()
@@ -173,25 +204,34 @@ class TestPShellCommand(unittest.TestCase):
 
     def test_shell_ipython_ordering(self):
         command = self._makeOne()
+        shell1_1 = dummy.DummyShell()
         shell0_11 = dummy.DummyShell()
         shell0_10 = dummy.DummyShell()
+        command.make_ipython_v1_1_shell = lambda: shell1_1
+        shell = command.make_shell()
+        self.assertEqual(shell, shell1_1)
+
+        command.make_ipython_v1_1_shell = lambda: None
         command.make_ipython_v0_11_shell = lambda: shell0_11
-        command.make_ipython_v0_10_shell = lambda: shell0_10
-        command.make_bpython_shell = lambda: None
         shell = command.make_shell()
         self.assertEqual(shell, shell0_11)
 
+        command.make_ipython_v0_11_shell = lambda: None
+        command.make_ipython_v0_10_shell = lambda: shell0_10
+        shell = command.make_shell()
+        self.assertEqual(shell, shell0_10)
+
         command.options.python_shell = 'ipython'
+        command.make_ipython_v1_1_shell = lambda: shell1_1
         shell = command.make_shell()
-        self.assertEqual(shell, shell0_11)
+        self.assertEqual(shell, shell1_1)
 
     def test_shell_ordering(self):
         command = self._makeOne()
         ipshell = dummy.DummyShell()
         bpshell = dummy.DummyShell()
         dshell = dummy.DummyShell()
-        command.make_ipython_v0_11_shell = lambda: None
-        command.make_ipython_v0_10_shell = lambda: None
+        command.make_ipython_shell = lambda: None
         command.make_bpython_shell = lambda: None
         command.make_default_shell = lambda: dshell
 
@@ -206,7 +246,7 @@ class TestPShellCommand(unittest.TestCase):
         shell = command.make_shell()
         self.assertEqual(shell, dshell)
 
-        command.make_ipython_v0_11_shell = lambda: ipshell
+        command.make_ipython_shell = lambda: ipshell
         command.make_bpython_shell = lambda: bpshell
         command.options.python_shell = 'ipython'
         shell = command.make_shell()
diff --git a/pyramid/tests/test_security.py b/pyramid/tests/test_security.py
index e530e33ca..6f08a100c 100644
--- a/pyramid/tests/test_security.py
+++ b/pyramid/tests/test_security.py
@@ -1,14 +1,13 @@
 import unittest
 
-from pyramid.testing import cleanUp
-
+from pyramid import testing
 
 class TestAllPermissionsList(unittest.TestCase):
     def setUp(self):
-        cleanUp()
+        testing.setUp()
 
     def tearDown(self):
-        cleanUp()
+        testing.tearDown()
 
     def _getTargetClass(self):
         from pyramid.security import AllPermissionsList
@@ -103,13 +102,101 @@ class TestACLDenied(unittest.TestCase):
         self.assertTrue('<ACLDenied instance at ' in repr(denied))
         self.assertTrue("with msg %r>" % msg in repr(denied))
 
-class TestViewExecutionPermitted(unittest.TestCase):
+class TestPrincipalsAllowedByPermission(unittest.TestCase):
     def setUp(self):
-        cleanUp()
+        testing.setUp()
+
+    def tearDown(self):
+        testing.tearDown()
+
+    def _callFUT(self, *arg):
+        from pyramid.security import principals_allowed_by_permission
+        return principals_allowed_by_permission(*arg)
+
+    def test_no_authorization_policy(self):
+        from pyramid.security import Everyone
+        context = DummyContext()
+        result = self._callFUT(context, 'view')
+        self.assertEqual(result, [Everyone])
+
+    def test_with_authorization_policy(self):
+        from pyramid.threadlocal import get_current_registry
+        registry = get_current_registry()
+        _registerAuthorizationPolicy(registry, 'yo')
+        context = DummyContext()
+        result = self._callFUT(context, 'view')
+        self.assertEqual(result, 'yo')
+
+class TestRemember(unittest.TestCase):
+    def setUp(self):
+        testing.setUp()
+        
+    def tearDown(self):
+        testing.tearDown()
+
+    def _callFUT(self, *arg):
+        from pyramid.security import remember
+        return remember(*arg)
+
+    def test_no_authentication_policy(self):
+        request = _makeRequest()
+        result = self._callFUT(request, 'me')
+        self.assertEqual(result, [])
 
+    def test_with_authentication_policy(self):
+        request = _makeRequest()
+        registry = request.registry
+        _registerAuthenticationPolicy(registry, 'yo')
+        result = self._callFUT(request, 'me')
+        self.assertEqual(result, [('X-Pyramid-Test', 'me')])
+
+    def test_with_authentication_policy_no_reg_on_request(self):
+        from pyramid.threadlocal import get_current_registry
+        registry = get_current_registry()
+        request = _makeRequest()
+        del request.registry
+        _registerAuthenticationPolicy(registry, 'yo')
+        result = self._callFUT(request, 'me')
+        self.assertEqual(result, [('X-Pyramid-Test', 'me')])
+
+class TestForget(unittest.TestCase):
+    def setUp(self):
+        testing.setUp()
+        
     def tearDown(self):
-        cleanUp()
+        testing.tearDown()
 
+    def _callFUT(self, *arg):
+        from pyramid.security import forget
+        return forget(*arg)
+
+    def test_no_authentication_policy(self):
+        request = _makeRequest()
+        result = self._callFUT(request)
+        self.assertEqual(result, [])
+
+    def test_with_authentication_policy(self):
+        request = _makeRequest()
+        _registerAuthenticationPolicy(request.registry, 'yo')
+        result = self._callFUT(request)
+        self.assertEqual(result, [('X-Pyramid-Test', 'logout')])
+
+    def test_with_authentication_policy_no_reg_on_request(self):
+        from pyramid.threadlocal import get_current_registry
+        registry = get_current_registry()
+        request = _makeRequest()
+        del request.registry
+        _registerAuthenticationPolicy(registry, 'yo')
+        result = self._callFUT(request)
+        self.assertEqual(result, [('X-Pyramid-Test', 'logout')])
+        
+class TestViewExecutionPermitted(unittest.TestCase):
+    def setUp(self):
+        testing.setUp()
+
+    def tearDown(self):
+        testing.tearDown()
+    
     def _callFUT(self, *arg, **kw):
         from pyramid.security import view_execution_permitted
         return view_execution_permitted(*arg, **kw)
@@ -140,7 +227,7 @@ class TestViewExecutionPermitted(unittest.TestCase):
         reg = get_current_registry()
         reg.registerUtility(settings, ISettings)
         context = DummyContext()
-        request = DummyRequest({})
+        request = testing.DummyRequest({})
         class DummyView(object):
             pass
         view = DummyView()
@@ -159,7 +246,7 @@ class TestViewExecutionPermitted(unittest.TestCase):
         reg = get_current_registry()
         reg.registerUtility(settings, ISettings)
         context = DummyContext()
-        request = DummyRequest({})
+        request = testing.DummyRequest({})
         self.assertRaises(TypeError, self._callFUT, context, request, '')
 
     def test_with_permission(self):
@@ -171,232 +258,197 @@ class TestViewExecutionPermitted(unittest.TestCase):
         context = DummyContext()
         directlyProvides(context, IContext)
         self._registerSecuredView('', True)
-        request = DummyRequest({})
+        request = testing.DummyRequest({})
         directlyProvides(request, IRequest)
         result = self._callFUT(context, request, '')
-        self.assertTrue(result is True)
-
-class TestHasPermission(unittest.TestCase):
-    def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
-
-    def _callFUT(self, *arg):
-        from pyramid.security import has_permission
-        return has_permission(*arg)
-
-    def test_no_authentication_policy(self):
-        request = _makeRequest()
-        result = self._callFUT('view', None, request)
-        self.assertEqual(result, True)
-        self.assertEqual(result.msg, 'No authentication policy in use.')
-        
-    def test_authentication_policy_no_authorization_policy(self):
-        request = _makeRequest()
-        _registerAuthenticationPolicy(request.registry, None)
-        self.assertRaises(ValueError, self._callFUT, 'view', None, request)
-
-    def test_authn_and_authz_policies_registered(self):
-        request = _makeRequest()
-        _registerAuthenticationPolicy(request.registry, None)
-        _registerAuthorizationPolicy(request.registry, 'yo')
-        self.assertEqual(self._callFUT('view', None, request), 'yo')
-
-    def test_no_registry_on_request(self):
-        from pyramid.threadlocal import get_current_registry
-        request = DummyRequest({})
-        registry = get_current_registry()
-        _registerAuthenticationPolicy(registry, None)
-        _registerAuthorizationPolicy(registry, 'yo')
-        self.assertEqual(self._callFUT('view', None, request), 'yo')
+        self.assertTrue(result)
 
 class TestAuthenticatedUserId(unittest.TestCase):
     def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
+        testing.setUp()
 
-    def _callFUT(self, request):
-        from pyramid.security import authenticated_userid
-        return authenticated_userid(request)
+    def tearDown(self):
+        testing.tearDown()
+        
+    def test_backward_compat_delegates_to_mixin(self):
+        from zope.deprecation import __show__
+        try:
+            __show__.off()
+            request = _makeFakeRequest()
+            from pyramid.security import authenticated_userid
+            self.assertEqual(
+                authenticated_userid(request),
+                'authenticated_userid'
+                )
+        finally:
+            __show__.on()
 
     def test_no_authentication_policy(self):
         request = _makeRequest()
-        result = self._callFUT(request)
-        self.assertEqual(result, None)
+        self.assertEqual(request.authenticated_userid, None)
 
     def test_with_authentication_policy(self):
         request = _makeRequest()
         _registerAuthenticationPolicy(request.registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.authenticated_userid, 'yo')
 
     def test_with_authentication_policy_no_reg_on_request(self):
         from pyramid.threadlocal import get_current_registry
-        request = DummyRequest({})
         registry = get_current_registry()
+        request = _makeRequest()
+        del request.registry
         _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.authenticated_userid, 'yo')
 
-class TestUnauthenticatedUserId(unittest.TestCase):
+class TestUnAuthenticatedUserId(unittest.TestCase):
     def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
+        testing.setUp()
 
-    def _callFUT(self, request):
-        from pyramid.security import unauthenticated_userid
-        return unauthenticated_userid(request)
+    def tearDown(self):
+        testing.tearDown()
+        
+    def test_backward_compat_delegates_to_mixin(self):
+        from zope.deprecation import __show__
+        try:
+            __show__.off()
+            request = _makeFakeRequest()
+            from pyramid.security import unauthenticated_userid
+            self.assertEqual(
+                unauthenticated_userid(request),
+                'unauthenticated_userid',
+                )
+        finally:
+            __show__.on()
 
     def test_no_authentication_policy(self):
         request = _makeRequest()
-        result = self._callFUT(request)
-        self.assertEqual(result, None)
+        self.assertEqual(request.unauthenticated_userid, None)
 
     def test_with_authentication_policy(self):
         request = _makeRequest()
         _registerAuthenticationPolicy(request.registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.unauthenticated_userid, 'yo')
 
     def test_with_authentication_policy_no_reg_on_request(self):
         from pyramid.threadlocal import get_current_registry
-        request = DummyRequest({})
         registry = get_current_registry()
+        request = _makeRequest()
+        del request.registry
         _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.unauthenticated_userid, 'yo')
 
 class TestEffectivePrincipals(unittest.TestCase):
     def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
+        testing.setUp()
 
-    def _callFUT(self, request):
-        from pyramid.security import effective_principals
-        return effective_principals(request)
+    def tearDown(self):
+        testing.tearDown()
+        
+    def test_backward_compat_delegates_to_mixin(self):
+        request = _makeFakeRequest()
+        from zope.deprecation import __show__
+        try:
+            __show__.off()
+            from pyramid.security import effective_principals
+            self.assertEqual(
+                effective_principals(request),
+                'effective_principals'
+                )
+        finally:
+            __show__.on()
 
     def test_no_authentication_policy(self):
         from pyramid.security import Everyone
         request = _makeRequest()
-        result = self._callFUT(request)
-        self.assertEqual(result, [Everyone])
+        self.assertEqual(request.effective_principals, [Everyone])
 
     def test_with_authentication_policy(self):
         request = _makeRequest()
         _registerAuthenticationPolicy(request.registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.effective_principals, 'yo')
 
     def test_with_authentication_policy_no_reg_on_request(self):
         from pyramid.threadlocal import get_current_registry
         registry = get_current_registry()
-        request = DummyRequest({})
+        request = _makeRequest()
+        del request.registry
         _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+        self.assertEqual(request.effective_principals, 'yo')
 
-class TestPrincipalsAllowedByPermission(unittest.TestCase):
-    def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
-
-    def _callFUT(self, *arg):
-        from pyramid.security import principals_allowed_by_permission
-        return principals_allowed_by_permission(*arg)
-
-    def test_no_authorization_policy(self):
-        from pyramid.security import Everyone
-        context = DummyContext()
-        result = self._callFUT(context, 'view')
-        self.assertEqual(result, [Everyone])
-
-    def test_with_authorization_policy(self):
-        from pyramid.threadlocal import get_current_registry
-        registry = get_current_registry()
-        _registerAuthorizationPolicy(registry, 'yo')
-        context = DummyContext()
-        result = self._callFUT(context, 'view')
-        self.assertEqual(result, 'yo')
-
-class TestRemember(unittest.TestCase):
+class TestHasPermission(unittest.TestCase):
     def setUp(self):
-        cleanUp()
+        testing.setUp()
         
     def tearDown(self):
-        cleanUp()
+        testing.tearDown()
 
-    def _callFUT(self, *arg):
-        from pyramid.security import remember
-        return remember(*arg)
+    def _makeOne(self):
+        from pyramid.security import AuthorizationAPIMixin
+        from pyramid.registry import Registry
+        mixin = AuthorizationAPIMixin()
+        mixin.registry = Registry()
+        mixin.context = object()
+        return mixin
+
+    def test_delegates_to_mixin(self):
+        from zope.deprecation import __show__
+        try:
+            __show__.off()
+            mixin = self._makeOne()
+            from pyramid.security import has_permission
+            self.called_has_permission = False
+
+            def mocked_has_permission(*args, **kw):
+                self.called_has_permission = True
+
+            mixin.has_permission = mocked_has_permission
+            has_permission('view', object(), mixin)
+            self.assertTrue(self.called_has_permission)
+        finally:
+            __show__.on()
 
     def test_no_authentication_policy(self):
-        request = _makeRequest()
-        result = self._callFUT(request, 'me')
-        self.assertEqual(result, [])
+        request = self._makeOne()
+        result = request.has_permission('view')
+        self.assertTrue(result)
+        self.assertEqual(result.msg, 'No authentication policy in use.')
 
-    def test_with_authentication_policy(self):
-        request = _makeRequest()
-        registry = request.registry
-        _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request, 'me')
-        self.assertEqual(result, 'yo')
+    def test_with_no_authorization_policy(self):
+        request = self._makeOne()
+        _registerAuthenticationPolicy(request.registry, None)
+        self.assertRaises(ValueError,
+                          request.has_permission, 'view', context=None)
 
-    def test_with_authentication_policy_no_reg_on_request(self):
+    def test_with_authn_and_authz_policies_registered(self):
+        request = self._makeOne()
+        _registerAuthenticationPolicy(request.registry, None)
+        _registerAuthorizationPolicy(request.registry, 'yo')
+        self.assertEqual(request.has_permission('view', context=None), 'yo')
+
+    def test_with_no_reg_on_request(self):
         from pyramid.threadlocal import get_current_registry
         registry = get_current_registry()
-        request = DummyRequest({})
-        _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request, 'me')
-        self.assertEqual(result, 'yo')
-
-class TestForget(unittest.TestCase):
-    def setUp(self):
-        cleanUp()
-        
-    def tearDown(self):
-        cleanUp()
-
-    def _callFUT(self, *arg):
-        from pyramid.security import forget
-        return forget(*arg)
+        request = self._makeOne()
+        del request.registry
+        _registerAuthenticationPolicy(registry, None)
+        _registerAuthorizationPolicy(registry, 'yo')
+        self.assertEqual(request.has_permission('view'), 'yo')
 
-    def test_no_authentication_policy(self):
-        request = _makeRequest()
-        result = self._callFUT(request)
-        self.assertEqual(result, [])
+    def test_with_no_context_passed(self):
+        request = self._makeOne()
+        self.assertTrue(request.has_permission('view'))
 
-    def test_with_authentication_policy(self):
-        request = _makeRequest()
-        _registerAuthenticationPolicy(request.registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+    def test_with_no_context_passed_or_on_request(self):
+        request = self._makeOne()
+        del request.context
+        self.assertRaises(AttributeError, request.has_permission, 'view')
 
-    def test_with_authentication_policy_no_reg_on_request(self):
-        from pyramid.threadlocal import get_current_registry
-        registry = get_current_registry()
-        request = DummyRequest({})
-        _registerAuthenticationPolicy(registry, 'yo')
-        result = self._callFUT(request)
-        self.assertEqual(result, 'yo')
+_TEST_HEADER = 'X-Pyramid-Test'
 
 class DummyContext:
     def __init__(self, *arg, **kw):
         self.__dict__.update(kw)
 
-class DummyRequest:
-    def __init__(self, environ):
-        self.environ = environ
-
 class DummyAuthenticationPolicy:
     def __init__(self, result):
         self.result = result
@@ -411,10 +463,14 @@ class DummyAuthenticationPolicy:
         return self.result
 
     def remember(self, request, principal, **kw):
-        return self.result
+        headers = [(_TEST_HEADER, principal)]
+        self._header_remembered = headers[0]
+        return headers
 
     def forget(self, request):
-        return self.result
+        headers = [(_TEST_HEADER, 'logout')]
+        self._header_forgotten = headers[0]
+        return headers
 
 class DummyAuthorizationPolicy:
     def __init__(self, result):
@@ -440,8 +496,24 @@ def _registerAuthorizationPolicy(reg, result):
 
 def _makeRequest():
     from pyramid.registry import Registry
-    request = DummyRequest({})
+    request = testing.DummyRequest(environ={})
     request.registry = Registry()
+    request.context = object()
     return request
 
+def _makeFakeRequest():
+    class FakeRequest(testing.DummyRequest):
+        @property
+        def authenticated_userid(req):
+            return 'authenticated_userid'
+
+        @property
+        def unauthenticated_userid(req):
+            return 'unauthenticated_userid'
+
+        @property
+        def effective_principals(req):
+            return 'effective_principals'
+
+    return FakeRequest({})
 
diff --git a/pyramid/tests/test_session.py b/pyramid/tests/test_session.py
index 35e2b5c27..a9f70d6a0 100644
--- a/pyramid/tests/test_session.py
+++ b/pyramid/tests/test_session.py
@@ -1,10 +1,8 @@
+import json
 import unittest
 from pyramid import testing
 
-class TestUnencryptedCookieSession(unittest.TestCase):
-    def _makeOne(self, request, **kw):
-        from pyramid.session import UnencryptedCookieSessionFactoryConfig
-        return UnencryptedCookieSessionFactoryConfig('secret', **kw)(request)
+class SharedCookieSessionTests(object):
 
     def test_ctor_no_cookie(self):
         request = testing.DummyRequest()
@@ -18,36 +16,47 @@ class TestUnencryptedCookieSession(unittest.TestCase):
         session = self._makeOne(request)
         verifyObject(ISession, session)
 
-    def _serialize(self, accessed, state, secret='secret'):
-        from pyramid.session import signed_serialize
-        return signed_serialize((accessed, accessed, state), secret)
-        
     def test_ctor_with_cookie_still_valid(self):
         import time
         request = testing.DummyRequest()
-        cookieval = self._serialize(time.time(), {'state':1})
+        cookieval = self._serialize((time.time(), 0, {'state': 1}))
         request.cookies['session'] = cookieval
         session = self._makeOne(request)
         self.assertEqual(dict(session), {'state':1})
-        
+
     def test_ctor_with_cookie_expired(self):
         request = testing.DummyRequest()
-        cookieval = self._serialize(0, {'state':1})
+        cookieval = self._serialize((0, 0, {'state': 1}))
         request.cookies['session'] = cookieval
         session = self._makeOne(request)
         self.assertEqual(dict(session), {})
 
-    def test_ctor_with_bad_cookie(self):
+    def test_ctor_with_bad_cookie_cannot_deserialize(self):
+        request = testing.DummyRequest()
+        request.cookies['session'] = 'abc'
+        session = self._makeOne(request)
+        self.assertEqual(dict(session), {})
+
+    def test_ctor_with_bad_cookie_not_tuple(self):
         request = testing.DummyRequest()
-        cookieval = 'abc'
+        cookieval = self._serialize('abc')
         request.cookies['session'] = cookieval
         session = self._makeOne(request)
         self.assertEqual(dict(session), {})
 
+    def test_timeout(self):
+        import time
+        request = testing.DummyRequest()
+        cookieval = self._serialize((time.time() - 5, 0, {'state': 1}))
+        request.cookies['session'] = cookieval
+        session = self._makeOne(request, timeout=1)
+        self.assertEqual(dict(session), {})
+
     def test_changed(self):
         request = testing.DummyRequest()
         session = self._makeOne(request)
         self.assertEqual(session.changed(), None)
+        self.assertTrue(session._dirty)
 
     def test_invalidate(self):
         request = testing.DummyRequest()
@@ -56,6 +65,15 @@ class TestUnencryptedCookieSession(unittest.TestCase):
         self.assertEqual(session.invalidate(), None)
         self.assertFalse('a' in session)
 
+    def test_reissue_triggered(self):
+        import time
+        request = testing.DummyRequest()
+        cookieval = self._serialize((time.time() - 2, 0, {'state': 1}))
+        request.cookies['session'] = cookieval
+        session = self._makeOne(request)
+        self.assertEqual(session['state'], 1)
+        self.assertTrue(session._dirty)
+
     def test__set_cookie_on_exception(self):
         request = testing.DummyRequest()
         request.exception = True
@@ -95,16 +113,16 @@ class TestUnencryptedCookieSession(unittest.TestCase):
         request = testing.DummyRequest()
         request.exception = None
         session = self._makeOne(request,
-                                cookie_name = 'abc',
-                                cookie_path = '/foo',
-                                cookie_domain = 'localhost',
-                                cookie_secure = True,
-                                cookie_httponly = True,
+                                cookie_name='abc',
+                                path='/foo',
+                                domain='localhost',
+                                secure=True,
+                                httponly=True,
                                 )
         session['abc'] = 'x'
         response = Response()
         self.assertEqual(session._set_cookie(response), True)
-        cookieval= response.headerlist[-1][1]
+        cookieval = response.headerlist[-1][1]
         val, domain, path, secure, httponly = [x.strip() for x in
                                                cookieval.split(';')]
         self.assertTrue(val.startswith('abc='))
@@ -205,6 +223,199 @@ class TestUnencryptedCookieSession(unittest.TestCase):
         self.assertTrue(token)
         self.assertTrue('_csrft_' in session)
 
+    def test_no_set_cookie_with_exception(self):
+        import webob
+        request = testing.DummyRequest()
+        request.exception = True
+        session = self._makeOne(request, set_on_exception=False)
+        session['a'] = 1
+        callbacks = request.response_callbacks
+        self.assertEqual(len(callbacks), 1)
+        response = webob.Response()
+        result = callbacks[0](request, response)
+        self.assertEqual(result, None)
+        self.assertFalse('Set-Cookie' in dict(response.headerlist))
+
+    def test_set_cookie_with_exception(self):
+        import webob
+        request = testing.DummyRequest()
+        request.exception = True
+        session = self._makeOne(request)
+        session['a'] = 1
+        callbacks = request.response_callbacks
+        self.assertEqual(len(callbacks), 1)
+        response = webob.Response()
+        result = callbacks[0](request, response)
+        self.assertEqual(result, None)
+        self.assertTrue('Set-Cookie' in dict(response.headerlist))
+
+    def test_cookie_is_set(self):
+        import webob
+        request = testing.DummyRequest()
+        session = self._makeOne(request)
+        session['a'] = 1
+        callbacks = request.response_callbacks
+        self.assertEqual(len(callbacks), 1)
+        response = webob.Response()
+        result = callbacks[0](request, response)
+        self.assertEqual(result, None)
+        self.assertTrue('Set-Cookie' in dict(response.headerlist))
+
+class TestBaseCookieSession(SharedCookieSessionTests, unittest.TestCase):
+    def _makeOne(self, request, **kw):
+        from pyramid.session import BaseCookieSessionFactory
+        return BaseCookieSessionFactory(
+            dummy_serialize, dummy_deserialize, **kw)(request)
+
+    def _serialize(self, value):
+        return json.dumps(value)
+
+    def test_reissue_not_triggered(self):
+        import time
+        request = testing.DummyRequest()
+        cookieval = self._serialize((time.time(), 0, {'state': 1}))
+        request.cookies['session'] = cookieval
+        session = self._makeOne(request, reissue_time=1)
+        self.assertEqual(session['state'], 1)
+        self.assertFalse(session._dirty)
+
+class TestSignedCookieSession(SharedCookieSessionTests, unittest.TestCase):
+    def _makeOne(self, request, **kw):
+        from pyramid.session import SignedCookieSessionFactory
+        kw.setdefault('secret', 'secret')
+        return SignedCookieSessionFactory(**kw)(request)
+
+    def _serialize(self, value, salt=b'pyramid.session.', hashalg='sha512'):
+        import base64
+        import hashlib
+        import hmac
+        import pickle
+
+        digestmod = lambda: hashlib.new(hashalg)
+        cstruct = pickle.dumps(value, pickle.HIGHEST_PROTOCOL)
+        sig = hmac.new(salt + b'secret', cstruct, digestmod).digest()
+        return base64.b64encode(cstruct + sig)
+
+    def test_reissue_not_triggered(self):
+        import time
+        request = testing.DummyRequest()
+        cookieval = self._serialize((time.time(), 0, {'state': 1}))
+        request.cookies['session'] = cookieval
+        session = self._makeOne(request, reissue_time=1)
+        self.assertEqual(session['state'], 1)
+        self.assertFalse(session._dirty)
+
+    def test_custom_salt(self):
+        import time
+        request = testing.DummyRequest()
+        cookieval = self._serialize((time.time(), 0, {'state': 1}), salt=b'f.')
+        request.cookies['session'] = cookieval
+        session = self._makeOne(request, salt=b'f.')
+        self.assertEqual(session['state'], 1)
+
+    def test_salt_mismatch(self):
+        import time
+        request = testing.DummyRequest()
+        cookieval = self._serialize((time.time(), 0, {'state': 1}), salt=b'f.')
+        request.cookies['session'] = cookieval
+        session = self._makeOne(request, salt=b'g.')
+        self.assertEqual(session, {})
+
+    def test_custom_hashalg(self):
+        import time
+        request = testing.DummyRequest()
+        cookieval = self._serialize((time.time(), 0, {'state': 1}),
+                                    hashalg='sha1')
+        request.cookies['session'] = cookieval
+        session = self._makeOne(request, hashalg='sha1')
+        self.assertEqual(session['state'], 1)
+
+    def test_hashalg_mismatch(self):
+        import time
+        request = testing.DummyRequest()
+        cookieval = self._serialize((time.time(), 0, {'state': 1}),
+                                    hashalg='sha1')
+        request.cookies['session'] = cookieval
+        session = self._makeOne(request, hashalg='sha256')
+        self.assertEqual(session, {})
+
+    def test_secret_mismatch(self):
+        import time
+        request = testing.DummyRequest()
+        cookieval = self._serialize((time.time(), 0, {'state': 1}))
+        request.cookies['session'] = cookieval
+        session = self._makeOne(request, secret='evilsecret')
+        self.assertEqual(session, {})
+
+    def test_custom_serializer(self):
+        import base64
+        from hashlib import sha512
+        import hmac
+        import time
+        request = testing.DummyRequest()
+        cstruct = dummy_serialize((time.time(), 0, {'state': 1}))
+        sig = hmac.new(b'pyramid.session.secret', cstruct, sha512).digest()
+        cookieval = base64.b64encode(cstruct + sig)
+        request.cookies['session'] = cookieval
+        session = self._makeOne(request, deserialize=dummy_deserialize)
+        self.assertEqual(session['state'], 1)
+
+    def test_invalid_data_size(self):
+        from hashlib import sha512
+        import base64
+        request = testing.DummyRequest()
+        num_bytes = sha512().digest_size - 1
+        cookieval = base64.b64encode(b' ' * num_bytes)
+        request.cookies['session'] = cookieval
+        session = self._makeOne(request)
+        self.assertEqual(session, {})
+
+    def test_very_long_key(self):
+        verylongkey = b'a' * 1024
+        import webob
+        request = testing.DummyRequest()
+        session = self._makeOne(request, secret=verylongkey)
+        session['a'] = 1
+        callbacks = request.response_callbacks
+        self.assertEqual(len(callbacks), 1)
+        response = webob.Response()
+
+        try:
+            result = callbacks[0](request, response)
+        except TypeError as e: # pragma: no cover
+            self.fail('HMAC failed to initialize due to key length.')
+
+        self.assertEqual(result, None)
+        self.assertTrue('Set-Cookie' in dict(response.headerlist))
+
+class TestUnencryptedCookieSession(SharedCookieSessionTests, unittest.TestCase):
+    def setUp(self):
+        super(TestUnencryptedCookieSession, self).setUp()
+        from zope.deprecation import __show__
+        __show__.off()
+
+    def tearDown(self):
+        super(TestUnencryptedCookieSession, self).tearDown()
+        from zope.deprecation import __show__
+        __show__.on()
+        
+    def _makeOne(self, request, **kw):
+        from pyramid.session import UnencryptedCookieSessionFactoryConfig
+        self._rename_cookie_var(kw, 'path', 'cookie_path')
+        self._rename_cookie_var(kw, 'domain', 'cookie_domain')
+        self._rename_cookie_var(kw, 'secure', 'cookie_secure')
+        self._rename_cookie_var(kw, 'httponly', 'cookie_httponly')
+        self._rename_cookie_var(kw, 'set_on_exception', 'cookie_on_exception')
+        return UnencryptedCookieSessionFactoryConfig('secret', **kw)(request)
+
+    def _rename_cookie_var(self, kw, src, dest):
+        if src in kw:
+            kw.setdefault(dest, kw.pop(src))
+
+    def _serialize(self, value):
+        from pyramid.session import signed_serialize
+        return signed_serialize(value, 'secret')
+
     def test_serialize_option(self):
         from pyramid.response import Response
         secret = 'secret'
@@ -255,54 +466,48 @@ class Test_manage_accessed(unittest.TestCase):
     def test_accessed_set(self):
         request = testing.DummyRequest()
         session = DummySessionFactory(request)
-        session.accessed = None
+        session.renewed = 0
         wrapper = self._makeOne(session.__class__.get)
         wrapper(session, 'a')
         self.assertNotEqual(session.accessed, None)
-        
-    def test_already_dirty(self):
+        self.assertTrue(session._dirty)
+
+    def test_accessed_without_renew(self):
+        import time
         request = testing.DummyRequest()
         session = DummySessionFactory(request)
-        session._dirty = True
-        session['a'] = 1
+        session._reissue_time = 5
+        session.renewed = time.time()
         wrapper = self._makeOne(session.__class__.get)
-        self.assertEqual(wrapper.__doc__, session.get.__doc__)
-        result = wrapper(session, 'a')
-        self.assertEqual(result, 1)
-        callbacks = request.response_callbacks
-        self.assertEqual(len(callbacks), 0)
+        wrapper(session, 'a')
+        self.assertNotEqual(session.accessed, None)
+        self.assertFalse(session._dirty)
 
-    def test_with_exception(self):
-        import webob
+    def test_already_dirty(self):
         request = testing.DummyRequest()
-        request.exception = True
         session = DummySessionFactory(request)
+        session.renewed = 0
+        session._dirty = True
         session['a'] = 1
         wrapper = self._makeOne(session.__class__.get)
         self.assertEqual(wrapper.__doc__, session.get.__doc__)
         result = wrapper(session, 'a')
         self.assertEqual(result, 1)
         callbacks = request.response_callbacks
-        self.assertEqual(len(callbacks), 1)
-        response = webob.Response()
-        result = callbacks[0](request, response)
-        self.assertEqual(result, None)
-        self.assertFalse('Set-Cookie' in dict(response.headerlist))
+        self.assertEqual(len(callbacks), 0)
 
-    def test_cookie_is_set(self):
+class Test_manage_changed(unittest.TestCase):
+    def _makeOne(self, wrapped):
+        from pyramid.session import manage_changed
+        return manage_changed(wrapped)
+
+    def test_it(self):
         request = testing.DummyRequest()
         session = DummySessionFactory(request)
-        session['a'] = 1
-        wrapper = self._makeOne(session.__class__.get)
-        self.assertEqual(wrapper.__doc__, session.get.__doc__)
-        result = wrapper(session, 'a')
-        self.assertEqual(result, 1)
-        callbacks = request.response_callbacks
-        self.assertEqual(len(callbacks), 1)
-        response = DummyResponse()
-        result = callbacks[0](request, response)
-        self.assertEqual(result, None)
-        self.assertEqual(session.response, response)
+        wrapper = self._makeOne(session.__class__.__setitem__)
+        wrapper(session, 'a', 1)
+        self.assertNotEqual(session.accessed, None)
+        self.assertTrue(session._dirty)
 
 def serialize(data, secret):
     import hmac
@@ -354,7 +559,7 @@ class Test_signed_deserialize(unittest.TestCase):
     def test_it_bad_encoding(self):
         serialized = 'bad' + serialize('123', 'secret')
         self.assertRaises(ValueError, self._callFUT, serialized, 'secret')
-        
+
 class Test_check_csrf_token(unittest.TestCase):
     def _callFUT(self, *args, **kwargs):
         from ..session import check_csrf_token
@@ -381,15 +586,22 @@ class Test_check_csrf_token(unittest.TestCase):
         self.assertEqual(self._callFUT(request), True)
 
     def test_failure_raises(self):
-        from pyramid.httpexceptions import HTTPBadRequest
+        from pyramid.exceptions import BadCSRFToken
         request = testing.DummyRequest()
-        self.assertRaises(HTTPBadRequest, self._callFUT, request, 'csrf_token')
+        self.assertRaises(BadCSRFToken, self._callFUT, request,
+                          'csrf_token')
 
     def test_failure_no_raises(self):
         request = testing.DummyRequest()
         result = self._callFUT(request, 'csrf_token', raises=False)
         self.assertEqual(result, False)
 
+def dummy_serialize(value):
+    return json.dumps(value).encode('utf-8')
+
+def dummy_deserialize(value):
+    return json.loads(value.decode('utf-8'))
+
 class DummySessionFactory(dict):
     _dirty = False
     _cookie_name = 'session'
@@ -399,13 +611,14 @@ class DummySessionFactory(dict):
     _cookie_secure = False
     _cookie_httponly = False
     _timeout = 1200
-    _secret = 'secret'
+    _reissue_time = 0
+
     def __init__(self, request):
         self.request = request
         dict.__init__(self, {})
 
-    def _set_cookie(self, response):
-        self.response = response
+    def changed(self):
+        self._dirty = True
 
 class DummyResponse(object):
     def __init__(self):
diff --git a/pyramid/tests/test_url.py b/pyramid/tests/test_url.py
index f6117777f..0a788ba97 100644
--- a/pyramid/tests/test_url.py
+++ b/pyramid/tests/test_url.py
@@ -6,7 +6,6 @@ from pyramid import testing
 
 from pyramid.compat import (
     text_,
-    native_,
     WIN,
     )
 
@@ -93,6 +92,14 @@ class TestURLMethodsMixin(unittest.TestCase):
         result = request.resource_url(context, 'a b c')
         self.assertEqual(result, 'http://example.com:5432/context/a%20b%20c')
 
+    def test_resource_url_with_query_str(self):
+        request = self._makeOne()
+        self._registerResourceURL(request.registry)
+        context = DummyContext()
+        result = request.resource_url(context, 'a', query='(openlayers)')
+        self.assertEqual(result,
+            'http://example.com:5432/context/a?(openlayers)')
+
     def test_resource_url_with_query_dict(self):
         request = self._makeOne()
         self._registerResourceURL(request.registry)
@@ -149,23 +156,18 @@ class TestURLMethodsMixin(unittest.TestCase):
         request = self._makeOne()
         self._registerResourceURL(request.registry)
         context = DummyContext()
-        uc = text_(b'La Pe\xc3\xb1a', 'utf-8') 
+        uc = text_(b'La Pe\xc3\xb1a', 'utf-8')
         result = request.resource_url(context, anchor=uc)
-        self.assertEqual(
-            result,
-            native_(
-                text_(b'http://example.com:5432/context/#La Pe\xc3\xb1a',
-                      'utf-8'),
-                'utf-8')
-            )
+        self.assertEqual(result,
+                         'http://example.com:5432/context/#La%20Pe%C3%B1a')
 
-    def test_resource_url_anchor_is_not_urlencoded(self):
+    def test_resource_url_anchor_is_urlencoded_safe(self):
         request = self._makeOne()
         self._registerResourceURL(request.registry)
         context = DummyContext()
-        result = request.resource_url(context, anchor=' /#')
+        result = request.resource_url(context, anchor=' /#?&+')
         self.assertEqual(result,
-                         'http://example.com:5432/context/# /#')
+                         'http://example.com:5432/context/#%20/%23?&+')
 
     def test_resource_url_no_IResourceURL_registered(self):
         # falls back to ResourceURL
@@ -448,14 +450,8 @@ class TestURLMethodsMixin(unittest.TestCase):
         request.registry.registerUtility(mapper, IRoutesMapper)
         result = request.route_url('flub', _anchor=b"La Pe\xc3\xb1a")
 
-        self.assertEqual(
-            result,
-            native_(
-                text_(
-                    b'http://example.com:5432/1/2/3#La Pe\xc3\xb1a',
-                    'utf-8'),
-                'utf-8')
-            )
+        self.assertEqual(result,
+                         'http://example.com:5432/1/2/3#La%20Pe%C3%B1a')
 
     def test_route_url_with_anchor_unicode(self):
         from pyramid.interfaces import IRoutesMapper
@@ -465,14 +461,8 @@ class TestURLMethodsMixin(unittest.TestCase):
         anchor = text_(b'La Pe\xc3\xb1a', 'utf-8')
         result = request.route_url('flub', _anchor=anchor)
 
-        self.assertEqual(
-            result,
-            native_(
-                text_(
-                    b'http://example.com:5432/1/2/3#La Pe\xc3\xb1a',
-                    'utf-8'),
-                'utf-8')
-            )
+        self.assertEqual(result,
+                         'http://example.com:5432/1/2/3#La%20Pe%C3%B1a')
 
     def test_route_url_with_query(self):
         from pyramid.interfaces import IRoutesMapper
@@ -483,6 +473,15 @@ class TestURLMethodsMixin(unittest.TestCase):
         self.assertEqual(result,
                          'http://example.com:5432/1/2/3?q=1')
 
+    def test_route_url_with_query_str(self):
+        from pyramid.interfaces import IRoutesMapper
+        request = self._makeOne()
+        mapper = DummyRoutesMapper(route=DummyRoute('/1/2/3'))
+        request.registry.registerUtility(mapper, IRoutesMapper)
+        result = request.route_url('flub', _query='(openlayers)')
+        self.assertEqual(result,
+                         'http://example.com:5432/1/2/3?(openlayers)')
+
     def test_route_url_with_empty_query(self):
         from pyramid.interfaces import IRoutesMapper
         request = self._makeOne()
diff --git a/pyramid/url.py b/pyramid/url.py
index fda2c72c7..484ee775f 100644
--- a/pyramid/url.py
+++ b/pyramid/url.py
@@ -12,12 +12,13 @@ from pyramid.interfaces import (
     )
 
 from pyramid.compat import (
-    native_,
     bytes_,
-    text_type,
-    url_quote,
+    string_types,
     )
-from pyramid.encode import urlencode
+from pyramid.encode import (
+    url_quote,
+    urlencode,
+)
 from pyramid.path import caller_package
 from pyramid.threadlocal import get_current_registry
 
@@ -27,6 +28,48 @@ from pyramid.traversal import (
     )
 
 PATH_SAFE = '/:@&+$,' # from webob
+QUERY_SAFE = '/?:@!$&\'()*+,;=' # RFC 3986
+ANCHOR_SAFE = QUERY_SAFE
+
+def parse_url_overrides(kw):
+    """Parse special arguments passed when generating urls.
+
+    The supplied dictionary is mutated, popping arguments as necessary.
+    Returns a 6-tuple of the format ``(app_url, scheme, host, port,
+    qs, anchor)``.
+    """
+    anchor = ''
+    qs = ''
+    app_url = None
+    host = None
+    scheme = None
+    port = None
+
+    if '_query' in kw:
+        query = kw.pop('_query')
+        if isinstance(query, string_types):
+            qs = '?' + url_quote(query, QUERY_SAFE)
+        elif query:
+            qs = '?' + urlencode(query, doseq=True)
+
+    if '_anchor' in kw:
+        anchor = kw.pop('_anchor')
+        anchor = url_quote(anchor, ANCHOR_SAFE)
+        anchor = '#' + anchor
+
+    if '_app_url' in kw:
+        app_url = kw.pop('_app_url')
+
+    if '_host' in kw:
+        host = kw.pop('_host')
+
+    if '_scheme' in kw:
+        scheme = kw.pop('_scheme')
+
+    if '_port' in kw:
+        port = kw.pop('_port')
+
+    return app_url, scheme, host, port, qs, anchor
 
 class URLMethodsMixin(object):
     """ Request methods mixin for BaseRequest having to do with URL
@@ -124,18 +167,22 @@ class URLMethodsMixin(object):
         ``*remainder`` replacement value, it is tacked on to the URL
         after being URL-quoted-except-for-embedded-slashes.
 
-        If no ``_query`` keyword argument is provided, the request
-        query string will be returned in the URL. If it is present, it
-        will be used to compose a query string that will be tacked on
-        to the end of the URL, replacing any request query string.
-        The value of ``_query`` must be a sequence of two-tuples *or*
-        a data structure with an ``.items()`` method that returns a
-        sequence of two-tuples (presumably a dictionary).  This data
-        structure will be turned into a query string per the
-        documentation of :func:`pyramid.encode.urlencode` function.
-        After the query data is turned into a query string, a leading
-        ``?`` is prepended, and the resulting string is appended to
-        the generated URL.
+        If no ``_query`` keyword argument is provided, the request query string
+        will be returned in the URL. If it is present, it will be used to
+        compose a query string that will be tacked on to the end of the URL,
+        replacing any request query string.  The value of ``_query`` may be a
+        sequence of two-tuples *or* a data structure with an ``.items()``
+        method that returns a sequence of two-tuples (presumably a dictionary).
+        This data structure will be turned into a query string per the
+        documentation of :func:`pyramid.url.urlencode` function.  This will
+        produce a query string in the ``x-www-form-urlencoded`` format.  A
+        non-``x-www-form-urlencoded`` query string may be used by passing a
+        *string* value as ``_query`` in which case it will be URL-quoted
+        (e.g. query="foo bar" will become "foo%20bar").  However, the result
+        will not need to be in ``k=v`` form as required by
+        ``x-www-form-urlencoded``.  After the query data is turned into a query
+        string, a leading ``?`` is prepended, and the resulting string is
+        appended to the generated URL.
 
         .. note::
 
@@ -146,8 +193,13 @@ class URLMethodsMixin(object):
            as values, and a k=v pair will be placed into the query string for
            each value.
 
+        .. versionchanged:: 1.5
+           Allow the ``_query`` option to be a string to enable alternative
+           encodings.
+
         If a keyword argument ``_anchor`` is present, its string
-        representation will be used as a named anchor in the generated URL
+        representation will be quoted per :rfc:`3986#section-3.5` and used as
+        a named anchor in the generated URL
         (e.g. if ``_anchor`` is passed as ``foo`` and the route URL is
         ``http://example.com/route/url``, the resulting generated URL will
         be ``http://example.com/route/url#foo``).
@@ -156,8 +208,11 @@ class URLMethodsMixin(object):
 
            If ``_anchor`` is passed as a string, it should be UTF-8 encoded. If
            ``_anchor`` is passed as a Unicode object, it will be converted to
-           UTF-8 before being appended to the URL.  The anchor value is not
-           quoted in any way before being appended to the generated URL.
+           UTF-8 before being appended to the URL.
+
+        .. versionchanged:: 1.5
+           The ``_anchor`` option will be escaped instead of using
+           its raw string representation.
 
         If both ``_anchor`` and ``_query`` are specified, the anchor
         element will always follow the query element,
@@ -213,34 +268,7 @@ class URLMethodsMixin(object):
         if route.pregenerator is not None:
             elements, kw = route.pregenerator(self, elements, kw)
 
-        anchor = ''
-        qs = ''
-        app_url = None
-        host = None
-        scheme = None
-        port = None
-
-        if '_query' in kw:
-            query = kw.pop('_query')
-            if query:
-                qs = '?' + urlencode(query, doseq=True)
-
-        if '_anchor' in kw:
-            anchor = kw.pop('_anchor')
-            anchor = native_(anchor, 'utf-8')
-            anchor = '#' + anchor
-
-        if '_app_url' in kw:
-            app_url = kw.pop('_app_url')
-
-        if '_host' in kw:
-            host = kw.pop('_host')
-
-        if '_scheme' in kw:
-            scheme = kw.pop('_scheme')
-
-        if '_port' in kw:
-            port = kw.pop('_port')
+        app_url, scheme, host, port, qs, anchor = parse_url_overrides(kw)
 
         if app_url is None:
             if (scheme is not None or host is not None or port is not None):
@@ -333,15 +361,20 @@ class URLMethodsMixin(object):
                      ``elements`` are used, the generated URL will *not*
                      end in trailing a slash.
 
-        If a keyword argument ``query`` is present, it will be used to
-        compose a query string that will be tacked on to the end of the URL.
-        The value of ``query`` must be a sequence of two-tuples *or* a data
-        structure with an ``.items()`` method that returns a sequence of
-        two-tuples (presumably a dictionary).  This data structure will be
-        turned into a query string per the documentation of
-        ``pyramid.url.urlencode`` function.  After the query data is turned
-        into a query string, a leading ``?`` is prepended, and the resulting
-        string is appended to the generated URL.
+        If a keyword argument ``query`` is present, it will be used to compose
+        a query string that will be tacked on to the end of the URL.  The value
+        of ``query`` may be a sequence of two-tuples *or* a data structure with
+        an ``.items()`` method that returns a sequence of two-tuples
+        (presumably a dictionary).  This data structure will be turned into a
+        query string per the documentation of :func:``pyramid.url.urlencode``
+        function.  This will produce a query string in the
+        ``x-www-form-urlencoded`` encoding.  A non-``x-www-form-urlencoded``
+        query string may be used by passing a *string* value as ``query`` in
+        which case it will be URL-quoted (e.g. query="foo bar" will become
+        "foo%20bar").  However, the result will not need to be in ``k=v`` form
+        as required by ``x-www-form-urlencoded``.  After the query data is
+        turned into a query string, a leading ``?`` is prepended, and the
+        resulting string is appended to the generated URL.
 
         .. note::
 
@@ -352,6 +385,10 @@ class URLMethodsMixin(object):
            as values, and a k=v pair will be placed into the query string for
            each value.
 
+        .. versionchanged:: 1.5
+           Allow the ``query`` option to be a string to enable alternative
+           encodings.
+
         If a keyword argument ``anchor`` is present, its string
         representation will be used as a named anchor in the generated URL
         (e.g. if ``anchor`` is passed as ``foo`` and the resource URL is
@@ -362,8 +399,11 @@ class URLMethodsMixin(object):
 
            If ``anchor`` is passed as a string, it should be UTF-8 encoded. If
            ``anchor`` is passed as a Unicode object, it will be converted to
-           UTF-8 before being appended to the URL.  The anchor value is not
-           quoted in any way before being appended to the generated URL.
+           UTF-8 before being appended to the URL.
+
+        .. versionchanged:: 1.5
+           The ``anchor`` option will be escaped instead of using
+           its raw string representation.
 
         If both ``anchor`` and ``query`` are specified, the anchor element
         will always follow the query element,
@@ -580,13 +620,14 @@ class URLMethodsMixin(object):
 
         if 'query' in kw:
             query = kw['query']
-            if query:
+            if isinstance(query, string_types):
+                qs = '?' + url_quote(query, QUERY_SAFE)
+            elif query:
                 qs = '?' + urlencode(query, doseq=True)
 
         if 'anchor' in kw:
             anchor = kw['anchor']
-            if isinstance(anchor, text_type):
-                anchor = native_(anchor, 'utf-8')
+            anchor = url_quote(anchor, ANCHOR_SAFE)
             anchor = '#' + anchor
 
         if elements: