Looking at this, I recalled that this is actually a port of the sqlobject identity provider from tg1 with csrf protection added by us.  With that in mind, I don't think we should make changes except to the copyright header (since we added that).  That will make it easier to tell what we changed via a diff against upstream and if we ever decided to rebase onto TG-1.5, it might be easier to tell how to adapt the code.