It's hard to tell, but through the structure of repoze.who and FriendlyForm makes it (nearly) impossible to do this. The request is complety handeled by it and when application code is called again(after procession by repoze.who, e.g. through plugins in `src/adhocracy/lib/auth`), it is impossible to access the session or request global variables(althrough it is possible to get the post values, the session object is unreachable).