Make it possible to protect only parts of an app.

Here's my use case for Django's Trac.

Anyone including GoogleBot should be allowed to browse Trac without having to authenticate.

When a user authenticates, Trac expects REMOTE_USER to be set on a request to /login. Then it creates its own session and doesn't neet REMOTE_USER anymore. Finally on /logout it destroys its session.

For this reason I want OAuth2 to be triggered only on /login, and only on /login. This pull requests make it possible.
Oops, fixed & force-pushed.