start reworking security policy

1 files changed, 6 insertions, 4 deletions

diff --git a/docs/whatsnew-2.0.rst b/docs/whatsnew-2.0.rst
index bf1554a27..4448e0f69 100644
--- a/docs/whatsnew-2.0.rst
+++ b/docs/whatsnew-2.0.rst
@@ -44,10 +44,12 @@ The new security policy adds the concept of an :term:`identity`, which is an
 object representing the user associated with the current request.  The identity
 can be accessed via :attr:`pyramid.request.Request.authenticated_identity`.
 The object can be of any shape, such as a simple ID string or an ORM object,
-but should implement a ``__str__`` method that returns a string identifying the
-current user, e.g. the ID of the user object in a database.  The string
-representation is return as
-:attr:`pyramid.request.Request.authenticated_userid`.
+and should represent an active user.
+
+As in previous version, the property :attr:`pyramid.request.Request.authenticated_userid`
+can be used to get a string identifying the current user, for example
+the ID of the user object in a database.  The value is obtained from the
+security policy.
 (:attr:`pyramid.request.Request.unauthenticated_userid` has been deprecated.)
 
 The concept of :term:`principals <principal>` has been removed; the