Security APIs on pyramid.request.Request

The pyramid.security Authorization API function has_permission is made available on the request.
The pyramid.security Authentication API functions are now available as
properties (unauthenticated_userid, authenticated_userid, effective_principals)
and methods (remember_userid, forget_userid) on pyramid.request.Request.

Backwards compatibility:
    For each of the APIs moved to request method or property,
    the original API in the pyramid.security module proxies to the request.

Reworked tests to check module level b/c wrappers call through to mixins for each API.
Tests that check no reg on request now do the right thing.
Use a response callback to set the request headers for forget_userid and remember_userid.

Update docs.

Attempt to improve a documentation section referencing the pyramid.security.has_permission
function in docs/narr/resources.rst

Ensures backwards compatiblity for `pyramid.security.forget`
and `pyramid.security.remember`.

1 files changed, 8 insertions, 0 deletions

diff --git a/CHANGES.txt b/CHANGES.txt
index 895dc572f..61f3b63f7 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -4,6 +4,14 @@ Unreleased
 Features
 --------
 
+- The :mod:``pyramid.security`` authentication API methods should now be 
+  accessed via the request. The ``pyramid.security`` authoriztion API function 
+  :meth:`has_permission` should now be accessed via the request.
+  The methods :meth:``pyramid.request.Request.forget_userid``, 
+  meth:``pyramid.request.Request.remember_userid`` now automatically 
+  set the headers on the response, as returned by the corrosponding 
+  method of the current request's :term:``authentication policy``.
+
 - Pyramid's console scripts (``pserve``, ``pviews``, etc) can now be run
   directly, allowing custom arguments to be sent to the python interpreter
   at runtime. For example::