mozilla/sauropod — pull request #24 by rfk (2011-12-16 04:00:47+00:00)
Title: Move authentication routines into a separate module.

This moves all the authentication- and session-related code into
a submodule. It also makes three changes to how auth is done:

* use HMAC-signed session tokens instead of UUIDs stored in memory
* configure browserid mocking in the config file instead of from
a command-line argument
* match asserted user/app against the URL and give a permission error
if they do not match