use a single serializer instead of serialize/deserialize in session.py, use SignedSerializer from (yet to be released) webob 1.3 instead of local logic in session.py
use CookieProfile from webob in authentication module, add support for new domain attribute on dummy request, depend on webob 1.3 or better