3 files changed, 42 insertions, 10 deletions
diff --git a/docs/narr/renderers.rst b/docs/narr/renderers.rst
index 63287e2cd..1158d2225 100644
--- a/docs/narr/renderers.rst
+++ b/docs/narr/renderers.rst
@@ -329,7 +329,7 @@ time "by hand".  Configure a JSONP renderer using the
 Once this renderer is registered via
 :meth:`~pyramid.config.Configurator.add_renderer` as above, you can use
 ``jsonp`` as the ``renderer=`` parameter to ``@view_config`` or
-:meth:`pyramid.config.Configurator.add_view``:
+:meth:`pyramid.config.Configurator.add_view`:
 
 .. code-block:: python
 
diff --git a/docs/narr/sessions.rst b/docs/narr/sessions.rst
index 1aa1b6341..f7da7838e 100644
--- a/docs/narr/sessions.rst
+++ b/docs/narr/sessions.rst
@@ -63,10 +63,15 @@ application by using the ``session_factory`` argument to the
    this implementation is, by default, *unencrypted*.  You should not use it
    when you keep sensitive information in the session object, as the
    information can be easily read by both users of your application and third
-   parties who have access to your users' network traffic.  Use a different
-   session factory implementation (preferably one which keeps session data on
-   the server) for anything but the most basic of applications where "session
-   security doesn't matter".
+   parties who have access to your users' network traffic.  And if you use this
+   sessioning implementation, and you inadvertently create a cross-site
+   scripting vulnerability in your application, because the session data is
+   stored unencrypted in a cookie, it will also be easier for evildoers to
+   obtain the current user's cross-site scripting token.  In short, use a
+   different session factory implementation (preferably one which keeps session
+   data on the server) for anything but the most basic of applications where
+   "session security doesn't matter", and you are sure your application has no
+   cross-site scripting vulnerabilities.
 
 .. index::
    single: session object
diff --git a/docs/narr/viewconfig.rst b/docs/narr/viewconfig.rst
index f65435cc6..6373a8d26 100644
--- a/docs/narr/viewconfig.rst
+++ b/docs/narr/viewconfig.rst
@@ -290,12 +290,13 @@ configured view.
   of the ``REQUEST_METHOD`` of the :term:`WSGI` environment.
 
 ``request_param``
-  This value can be any string.  A view declaration with this argument
-  ensures that the view will only be called when the :term:`request` has a
-  key in the ``request.params`` dictionary (an HTTP ``GET`` or ``POST``
-  variable) that has a name which matches the supplied value.
+  This value can be any string or a sequence of strings.  A view declaration 
+  with this argument ensures that the view will only be called when the 
+  :term:`request` has a key in the ``request.params`` dictionary (an HTTP 
+  ``GET`` or ``POST`` variable) that has a name which matches the a 
+  supplied value.
 
-  If the value supplied has a ``=`` sign in it,
+  If any value supplied has a ``=`` sign in it,
   e.g. ``request_param="foo=123"``, then the key (``foo``) must both exist
   in the ``request.params`` dictionary, *and* the value must match the right
   hand side of the expression (``123``) for the view to "match" the current
@@ -416,6 +417,32 @@ configured view.
 
   .. versionadded:: 1.4a2
 
+``physical_path``
+  If specified, this value should be a string or a tuple representing the
+  :term:`physical path` of the context found via traversal for this predicate
+  to match as true.  For example: ``physical_path='/'`` or
+  ``physical_path='/a/b/c'`` or ``physical_path=('', 'a', 'b', 'c')``.  This is
+  not a path prefix match or a regex, it's a whole-path match.  It's useful
+  when you want to always potentially show a view when some object is traversed
+  to, but you can't be sure about what kind of object it will be, so you can't
+  use the ``context`` predicate.  The individual path elements inbetween slash
+  characters or in tuple elements should be the Unicode representation of the
+  name of the resource and should not be encoded in any way.
+
+  .. versionadded:: 1.4a3
+
+``effective_principals``
+
+  If specified, this value should be a :term:`principal` identifier or a
+  sequence of principal identifiers.  If the
+  :func:`pyramid.security.effective_principals` method indicates that every
+  principal named in the argument list is present in the current request, this
+  predicate will return True; otherwise it will return False.  For example:
+  ``effective_principals=pyramid.security.Authenticated`` or
+  ``effective_principals=('fred', 'group:admins')``.
+
+  .. versionadded:: 1.4a4
+
 ``custom_predicates``
   If ``custom_predicates`` is specified, it must be a sequence of references
   to custom predicate callables.  Use custom predicates when no set of