I think you have the logic reversed here? REMOTE_USER is in request.environ when the user is logged in, so we don't need to obfuscate in that case.