Document how to secure the whole application

[pedersen]

This issue existed in Trac. The original can be viewed at http://trac.turbogears.org/ticket/2218

This issue existed on SourceForge. The original can be viewed at https://sourceforge.net/p/turbogears2/tickets/14

[pedersen]

Original Author: pedersen, Original Timestamp: 2011-03-10 03:46:16.297000

Original Body: We should explain how to secure the whole application, while excluding the authentication-related URLs if using a repoze.who !RedirectingFormPlugin-like challenger.

See also:
http://groups.google.com/group/turbogears-trunk/t/97c0e11a4d538a1d

[pedersen]

Original Author: amolsf, Original Timestamp: 2012-04-03 19:27:21.627000

Original Body: This is probably achievable in a more TG way of doing things by using _lookup inside of the RootController returning the object with the secured set of methods for the RootController.

This is easier and avoids having to mess with the underground authentication layer. Should probably be documented anyway.

[pedersen]

Original Author: pedersen, Original Timestamp: 2012-08-24 01:34:54.558000

Original Body: - version: 2.1.0 --> 2.1.5

• milestone: 2.2.0 --> 2.3.0