'Accepts a standard WSGI application call, authenticating the request
and installing callback hooks for authorization and ACL header
validation. For an authenticated request, REMOTE_USER will be set to a
comma separated list of the user\'s groups.
With a non-empty reseller prefix, acts as the definitive auth service
for just tokens and accounts that begin with that prefix, but will deny
requests outside this prefix if no other auth middleware overrides it.
With an empty reseller prefix, acts as the definitive auth service only
for tokens that validate to a non-empty set of groups. For all other
requests, acts as the fallback auth service when no other auth
middleware overrides it.
Alternatively, if the request matches the self.auth_prefix, the request
will be routed through the internal auth request handler (self.handle).
This is to handle granting tokens, etc.'

def __call__(self, env, start_response):

    if (self.allow_overrides and env.get('swift.authorize_override', False)):
        return self.app(env, start_response)
    if env.get('PATH_INFO', '').startswith(self.auth_prefix):
        return self.handle(env, start_response)
    s3 = env.get('swift3.auth_details')
    token = env.get('HTTP_X_AUTH_TOKEN', env.get('HTTP_X_STORAGE_TOKEN'))
    service_token = env.get('HTTP_X_SERVICE_TOKEN')
    if (s3 or (token and token.startswith(self.reseller_prefix))):
        groups = self.get_groups(env, token)
        if service_token:
            service_groups = self.get_groups(env, service_token)
            if (groups and service_groups):
                groups += (',' + service_groups)
        if groups:
            user = ((groups and groups.split(',', 1)[0]) or '')
            trans_id = env.get('swift.trans_id')
            self.logger.debug(('User:    %s    uses    token    %s    (trans_id    %s)' % (user, ('s3' if s3 else token), trans_id)))
            env['REMOTE_USER'] = groups
            env['swift.authorize'] = self.authorize
            env['swift.clean_acl'] = clean_acl
            if ('.reseller_admin' in groups):
                env['reseller_request'] = True
        elif (self.reseller_prefix and (not s3)):
            self.logger.increment('unauthorized')
            try:
                (vrs, realm, rest) = split_path(env['PATH_INFO'], 2, 3, True)
            except ValueError:
                realm = 'unknown'
            return HTTPUnauthorized(headers={'Www-Authenticate': ('Swift    realm="%s"' % realm)})(env, start_response)
        elif ('swift.authorize' not in env):
            env['swift.authorize'] = self.denied_response
    elif self._is_definitive_auth(env.get('PATH_INFO', '')):
        env['swift.authorize'] = self.authorize
        env['swift.clean_acl'] = clean_acl
    elif (self.reseller_prefix == ''):
        if ('swift.authorize' not in env):
            env['swift.authorize'] = self.authorize
            env['swift.clean_acl'] = clean_acl
    elif ('swift.authorize' not in env):
        env['swift.authorize'] = self.denied_response
    return self.app(env, start_response)
