def __call__(self, env, start_response):
if '<STR_LIT>' in env:<EOL><INDENT>return self.app(env, start_response)<EOL><DEDENT>if env.get('<STR_LIT>') == '<STR_LIT>':<EOL><INDENT>return self.app(env, start_response)<EOL><DEDENT>if self.allow_overrides and env.get('<STR_LIT>', False):<EOL><INDENT>return self.app(env, start_response)<EOL><DEDENT>if not self.swauth_remote:<EOL><INDENT>if env.get('<STR_LIT>', '<STR_LIT>') == self.auth_prefix[:-<NUM_LIT:1>]:<EOL><INDENT>return HTTPMovedPermanently(add_slash=True)(env,<EOL>start_response)<EOL><DEDENT>elif env.get('<STR_LIT>', '<STR_LIT>').startswith(self.auth_prefix):<EOL><INDENT>return self.handle(env, start_response)<EOL><DEDENT><DEDENT>s3 = env.get('<STR_LIT>')<EOL>if s3 and not self.s3_support:<EOL><INDENT>msg = '<STR_LIT>'<EOL>return HTTPBadRequest(body=msg)(env, start_response)<EOL><DEDENT>token = env.get('<STR_LIT>', env.get('<STR_LIT>'))<EOL>if token and len(token) > swauth.authtypes.MAX_TOKEN_LENGTH:<EOL><INDENT>return HTTPBadRequest(body='<STR_LIT>')(env,<EOL>start_response)<EOL><DEDENT>if s3 or (token and token.startswith(self.reseller_prefix)):<EOL><INDENT>groups = self.get_groups(env, token)<EOL>if groups:<EOL><INDENT>env['<STR_LIT>'] = groups<EOL>user = groups and groups.split('<STR_LIT:U+002C>', <NUM_LIT:1>)[<NUM_LIT:0>] or '<STR_LIT>'<EOL>env['<STR_LIT>'] ='<STR_LIT>' % (user, '<STR_LIT>' if s3 else token)<EOL>env['<STR_LIT>'] = self.authorize<EOL>env['<STR_LIT>'] = clean_acl<EOL>if '<STR_LIT>' in groups:<EOL><INDENT>env['<STR_LIT>'] = True<EOL><DEDENT><DEDENT>else:<EOL><INDENT>if self.reseller_prefix and token andtoken.startswith(self.reseller_prefix):<EOL><INDENT>return HTTPUnauthorized()(env, start_response)<EOL><DEDENT>elif '<STR_LIT>' not in env:<EOL><INDENT>env['<STR_LIT>'] = self.denied_response<EOL><DEDENT><DEDENT><DEDENT>else:<EOL><INDENT>if self.reseller_prefix:<EOL><INDENT>try:<EOL><INDENT>version, rest = split_path(env.get('<STR_LIT>', '<STR_LIT>'),<EOL><NUM_LIT:1>, <NUM_LIT:2>, True)<EOL><DEDENT>except ValueError:<EOL><INDENT>rest = None<EOL><DEDENT>if rest and rest.startswith(self.reseller_prefix):<EOL><INDENT>env['<STR_LIT>'] = self.authorize<EOL>env['<STR_LIT>'] = clean_acl<EOL><DEDENT>elif '<STR_LIT>' not in env:<EOL><INDENT>env['<STR_LIT>'] = self.denied_response<EOL><DEDENT><DEDENT>elif '<STR_LIT>' not in env:<EOL><INDENT>env['<STR_LIT>'] = self.authorize<EOL>env['<STR_LIT>'] = clean_acl<EOL><DEDENT><DEDENT>return self.app(env, start_response)<EOL>
Accepts a standard WSGI application call, authenticating the request
        and installing callback hooks for authorization and ACL header
        validation. For an authenticated request, REMOTE_USER will be set to a
        comma separated list of the user's groups.

        With a non-empty reseller prefix, acts as the definitive auth service
        for just tokens and accounts that begin with that prefix, but will deny
        requests outside this prefix if no other auth middleware overrides it.

        With an empty reseller prefix, acts as the definitive auth service only
        for tokens that validate to a non-empty set of groups. For all other
        requests, acts as the fallback auth service when no other auth
        middleware overrides it.

        Alternatively, if the request matches the self.auth_prefix, the request
        will be routed through the internal auth request handler (self.handle).
        This is to handle creating users, accounts, granting tokens, etc.