prompt: You will be provided with a partial code base and an issue statement explaining a problem to resolve.
  <issue>
  can't stay logged in
  from @amaltson via [Twitter](https://twitter.com/amaltson/status/332678066985893889):
  
  > trying to log in with GitHub, each time I go to my account page, I get logged out.. 
  
  
  </issue>
  <code>
  [start of gittip/security/authentication.py]
  1 """Defines website authentication helpers.
  2 """
  3 import rfc822
  4 import time
  5 
  6 from aspen import Response
  7 from gittip.security import csrf
  8 from gittip.security.user import User
  9 
  10 
  11 BEGINNING_OF_EPOCH = rfc822.formatdate(0)
  12 TIMEOUT = 60 * 60 * 24 * 7 # one week
  13 ROLES = ['anonymous', 'authenticated', 'owner', 'admin']
  14 ROLES_SHOULD_BE = "It should be one of: {}.".format(', '.join(ROLES))
  15 
  16 
  17 class NoMinimumRoleSpecified(Exception):
  18     def __str__(self):
  19         return "There is no minimum_role specified in the simplate at {}. {}" \
  20                .format(self.args[0], ROLES_SHOULD_BE)
  21 
  22 class BadMinimumRole(Exception):
  23     def __str__(self):
  24         return "The minimum_role specific in {} is bad: {}. {}" \
  25                .format(self.args[0], self.args[1], ROLES_SHOULD_BE)
  26 
  27 
  28 def inbound(request):
  29     """Authenticate from a cookie or an API key in basic auth.
  30     """
  31     user = None
  32     if 'Authorization' in request.headers:
  33         header = request.headers['authorization']
  34         if header.startswith('Basic '):
  35             creds = header[len('Basic '):].decode('base64')
  36             token, ignored = creds.split(':')
  37             user = User.from_api_key(token)
  38 
  39             # We don't require CSRF if they basically authenticated.
  40             csrf_token = csrf._get_new_csrf_key()
  41             request.headers.cookie['csrf_token'] = csrf_token
  42             request.headers['X-CSRF-TOKEN'] = csrf_token
  43             if 'Referer' not in request.headers:
  44                 request.headers['Referer'] = \
  45                                         'https://%s/' % csrf._get_host(request)
  46     elif 'session' in request.headers.cookie:
  47         token = request.headers.cookie['session'].value
  48         user = User.from_session_token(token)
  49 
  50     if user is None:
  51         user = User()
  52     request.context['user'] = user
  53 
  54 
  55 def check_role(request):
  56     """Given a request object, possibly raise Response(403).
  57     """
  58 
  59     # XXX We can't use this yet because we don't have an inbound Aspen hook
  60     # that fires after the first page of the simplate is exec'd.
  61 
  62     context = request.context
  63     path = request.line.uri.path
  64 
  65     if 'minimum_role' not in context:
  66         raise NoMinimumRoleSpecified(request.fs)
  67 
  68     minimum_role = context['minimum_role']
  69     if minimum_role not in ROLES:
  70         raise BadMinimumRole(request.fs, minimum_role)
  71 
  72     user = context['user']
  73     highest_role = user.get_highest_role(path.get('username', None))
  74     if ROLES.index(highest_role) < ROLES.index(minimum_role):
  75         request.redirect('..')
  76 
  77 
  78 def outbound(response):
  79     if 'user' in response.request.context:
  80         user = response.request.context['user']
  81         if not isinstance(user, User):
  82             raise Response(400, "If you define 'user' in a simplate it has to "
  83                                 "be a User instance.")
  84     else:
  85         user = User()
  86 
  87     if user.ANON: # user is anonymous
  88         if 'session' not in response.request.headers.cookie:
  89             # no cookie in the request, don't set one on response
  90             return
  91         else:
  92             # expired cookie in the request, instruct browser to delete it
  93             response.headers.cookie['session'] = ''
  94             expires = 0
  95     else: # user is authenticated
  96         response.headers['Expires'] = BEGINNING_OF_EPOCH # don't cache
  97         response.headers.cookie['session'] = user.participant.session_token
  98         expires = time.time() + TIMEOUT
  99         user.keep_signed_in_until(expires)
  100 
  101     cookie = response.headers.cookie['session']
  102     # I am not setting domain, because it is supposed to default to what we
  103     # want: the domain of the object requested.
  104     #cookie['domain']
  105     cookie['path'] = '/'
  106     cookie['expires'] = rfc822.formatdate(expires)
  107     cookie['httponly'] = "Yes, please."
  108
  [end of gittip/security/authentication.py]
  </code>
  
  I need you to solve this issue by generating a single patch file that I can apply directly to this repository using git apply. Please respond with a single patch file in the following format.
  <patch>
  diff --git a/file.py b/file.py
  --- a/file.py
  +++ b/file.py
  @@ -1,27 +1,35 @@
   def euclidean(a, b):
  -    while b:
  -        a, b = b, a % b
  -    return a
  +    if b == 0:
  +        return a
  +    return euclidean(b, a % b)
   
   
   def bresenham(x0, y0, x1, y1):
       points = []
       dx = abs(x1 - x0)
       dy = abs(y1 - y0)
  -    sx = 1 if x0 < x1 else -1
  -    sy = 1 if y0 < y1 else -1
  -    err = dx - dy
  +    x, y = x0, y0
  +    sx = -1 if x0 > x1 else 1
  +    sy = -1 if y0 > y1 else 1
   
  -    while True:
  -        points.append((x0, y0))
  -        if x0 == x1 and y0 == y1:
  -            break
  -        e2 = 2 * err
  -        if e2 > -dy:
  -            err -= dy
  -            x0 += sx
  -        if e2 < dx:
  -            err += dx
  -            y0 += sy
  +    if dx > dy:
  +        err = dx / 2.0
  +        while x != x1:
  +            points.append((x, y))
  +            err -= dy
  +            if err < 0:
  +                y += sy
  +                err += dx
  +            x += sx
  +    else:
  +        err = dy / 2.0
  +        while y != y1:
  +            points.append((x, y))
  +            err -= dx
  +            if err < 0:
  +                x += sx
  +                err += dy
  +            y += sy
  +
  +    points.append((x, y))
       return points
  
  </patch>
golden_diff: diff --git a/gittip/security/authentication.py b/gittip/security/authentication.py
  --- a/gittip/security/authentication.py
  +++ b/gittip/security/authentication.py
  @@ -3,6 +3,7 @@
   import rfc822
   import time
   
  +import gittip
   from aspen import Response
   from gittip.security import csrf
   from gittip.security.user import User
  @@ -105,3 +106,5 @@
       cookie['path'] = '/'
       cookie['expires'] = rfc822.formatdate(expires)
       cookie['httponly'] = "Yes, please."
  +    if gittip.canonical_scheme == 'https':
  +        cookie['secure'] = "Yes, please."
  
verification_info: {"golden_diff": "diff --git a/gittip/security/authentication.py b/gittip/security/authentication.py\n--- a/gittip/security/authentication.py\n+++ b/gittip/security/authentication.py\n@@ -3,6 +3,7 @@\n import rfc822\n import time\n \n+import gittip\n from aspen import Response\n from gittip.security import csrf\n from gittip.security.user import User\n@@ -105,3 +106,5 @@\n     cookie['path'] = '/'\n     cookie['expires'] = rfc822.formatdate(expires)\n     cookie['httponly'] = \"Yes, please.\"\n+    if gittip.canonical_scheme == 'https':\n+        cookie['secure'] = \"Yes, please.\"\n", "issue": "can't stay logged in\nfrom @amaltson via [Twitter](https://twitter.com/amaltson/status/332678066985893889):\n\n> trying to log in with GitHub, each time I go to my account page, I get logged out.. \n\n", "before_files": [{"content": "\"\"\"Defines website authentication helpers.\n\"\"\"\nimport rfc822\nimport time\n\nfrom aspen import Response\nfrom gittip.security import csrf\nfrom gittip.security.user import User\n\n\nBEGINNING_OF_EPOCH = rfc822.formatdate(0)\nTIMEOUT = 60 * 60 * 24 * 7 # one week\nROLES = ['anonymous', 'authenticated', 'owner', 'admin']\nROLES_SHOULD_BE = \"It should be one of: {}.\".format(', '.join(ROLES))\n\n\nclass NoMinimumRoleSpecified(Exception):\n    def __str__(self):\n        return \"There is no minimum_role specified in the simplate at {}. {}\" \\\n               .format(self.args[0], ROLES_SHOULD_BE)\n\nclass BadMinimumRole(Exception):\n    def __str__(self):\n        return \"The minimum_role specific in {} is bad: {}. {}\" \\\n               .format(self.args[0], self.args[1], ROLES_SHOULD_BE)\n\n\ndef inbound(request):\n    \"\"\"Authenticate from a cookie or an API key in basic auth.\n    \"\"\"\n    user = None\n    if 'Authorization' in request.headers:\n        header = request.headers['authorization']\n        if header.startswith('Basic '):\n            creds = header[len('Basic '):].decode('base64')\n            token, ignored = creds.split(':')\n            user = User.from_api_key(token)\n\n            # We don't require CSRF if they basically authenticated.\n            csrf_token = csrf._get_new_csrf_key()\n            request.headers.cookie['csrf_token'] = csrf_token\n            request.headers['X-CSRF-TOKEN'] = csrf_token\n            if 'Referer' not in request.headers:\n                request.headers['Referer'] = \\\n                                        'https://%s/' % csrf._get_host(request)\n    elif 'session' in request.headers.cookie:\n        token = request.headers.cookie['session'].value\n        user = User.from_session_token(token)\n\n    if user is None:\n        user = User()\n    request.context['user'] = user\n\n\ndef check_role(request):\n    \"\"\"Given a request object, possibly raise Response(403).\n    \"\"\"\n\n    # XXX We can't use this yet because we don't have an inbound Aspen hook\n    # that fires after the first page of the simplate is exec'd.\n\n    context = request.context\n    path = request.line.uri.path\n\n    if 'minimum_role' not in context:\n        raise NoMinimumRoleSpecified(request.fs)\n\n    minimum_role = context['minimum_role']\n    if minimum_role not in ROLES:\n        raise BadMinimumRole(request.fs, minimum_role)\n\n    user = context['user']\n    highest_role = user.get_highest_role(path.get('username', None))\n    if ROLES.index(highest_role) < ROLES.index(minimum_role):\n        request.redirect('..')\n\n\ndef outbound(response):\n    if 'user' in response.request.context:\n        user = response.request.context['user']\n        if not isinstance(user, User):\n            raise Response(400, \"If you define 'user' in a simplate it has to \"\n                                \"be a User instance.\")\n    else:\n        user = User()\n\n    if user.ANON: # user is anonymous\n        if 'session' not in response.request.headers.cookie:\n            # no cookie in the request, don't set one on response\n            return\n        else:\n            # expired cookie in the request, instruct browser to delete it\n            response.headers.cookie['session'] = ''\n            expires = 0\n    else: # user is authenticated\n        response.headers['Expires'] = BEGINNING_OF_EPOCH # don't cache\n        response.headers.cookie['session'] = user.participant.session_token\n        expires = time.time() + TIMEOUT\n        user.keep_signed_in_until(expires)\n\n    cookie = response.headers.cookie['session']\n    # I am not setting domain, because it is supposed to default to what we\n    # want: the domain of the object requested.\n    #cookie['domain']\n    cookie['path'] = '/'\n    cookie['expires'] = rfc822.formatdate(expires)\n    cookie['httponly'] = \"Yes, please.\"\n", "path": "gittip/security/authentication.py"}]}