The basic identity and authorization system is starting to take shape.
Need to write tests for basic auth identity policy though.

See http://plope.com/pyramid_auth_design_api_postmortem which served
as inspiration.