Upgrade repoze.who to version 2.0

This will allow the dependent tickets #1942, #1941, #1720 to be resolved and it related to #1661.