Security APIs on pyramid.request.Request

The pyramid.security Authorization API function has_permission is made available on the request.
The pyramid.security Authentication API functions are now available as
properties (unauthenticated_userid, authenticated_userid, effective_principals)
and methods (remember_userid, forget_userid) on pyramid.request.Request.

Backwards compatibility:
    For each of the APIs moved to request method or property,
    the original API in the pyramid.security module proxies to the request.

Reworked tests to check module level b/c wrappers call through to mixins for each API.
Tests that check no reg on request now do the right thing.
Use a response callback to set the request headers for forget_userid and remember_userid.

Update docs.

Attempt to improve a documentation section referencing the pyramid.security.has_permission
function in docs/narr/resources.rst

Ensures backwards compatiblity for `pyramid.security.forget`
and `pyramid.security.remember`.
Merge branch 'master' of github.com:Pylons/pyramid
Merge branch 'security-apis-on-request' of github.com:mgrbyte/pyramid into mgrbyte-security-apis-on-request
Bring change log, API docs, and deprecations in line with normal policies/processes
add on_exception flag to remember/forget, fix a bug in _remember_userid and _forget_userid (these should always return a sequence even if there is no authentication policy), defactorize tests
defer looking up headers until the response callback is called (FBO things like sessionauthenticationpolicy which does its own header-setting when its remember/forget methods are called)
avoid a deprecation warning during test runs
add NB notes about recursive add_response_callback policies, use req instead of self for normalization with exception getting
wording and specify return value
fix zodb tutorial wrt request-based authentication and authorization apis
copy forward views.py changes to tests step
fix wiki2 tutorial wrt request-method security APIs
rendering
wording
not methods, attrs
note deprecation
convert remember/forget to request-method-based
new api
fix failing test (unrelated to security stuff)
rendering