Adding basic docs
Supporting testing on python 2.6
Normalizing log messages
Trusting unauthenticated server responses that are not 2xx messages.

It's fairly common for servers to not authenticate certain types of messages
like redirects which are redirecting the request to the server which actually
owns the resource. The redirecting web server isn't protecting the resource
itself, so it doesn't authenticate the user and cannot authenticate the
response. While this is in no way ideal, it's common enough to cause problems in
every day use. Similarly, broken web servers which send 5xx errors are not
likely able to authenticate those 5xx messages.

This is questionable from a security perspective but is pragmatically necessary.
Auth handlers are called with prepared request objects, not responses.