'Returns None if the request is authorized to continue or a standard
WSGI response callable if not.'

def authorize(self, req):

    try:
        (_junk, account, container, obj) = req.split_path(1, 4, True)
    except ValueError:
        self.logger.increment('errors')
        return HTTPNotFound(request=req)
    if (self._get_account_prefix(account) is None):
        self.logger.debug(("Account    name:    %s    doesn't    start    with    reseller_prefix(s):    %s." % (account, ','.join(self.reseller_prefixes))))
        return self.denied_response(req)
    acl_data = req.headers.get('x-account-access-control')
    if (acl_data is not None):
        error = self.extract_acl_and_report_errors(req)
        if error:
            msg = ('X-Account-Access-Control    invalid:    %s\n\nInput:    %s\n' % (error, acl_data))
            headers = [('Content-Type', 'text/plain;    charset=UTF-8')]
            return HTTPBadRequest(request=req, headers=headers, body=msg)
    user_groups = (req.remote_user or '').split(',')
    account_user = (user_groups[1] if (len(user_groups) > 1) else None)
    if (('.reseller_admin' in user_groups) and (account not in self.reseller_prefixes) and (not self._dot_account(account))):
        req.environ['swift_owner'] = True
        self.logger.debug(('User    %s    has    reseller    admin    authorizing.' % account_user))
        return None
    if ((account in user_groups) and ((req.method not in ('DELETE', 'PUT')) or container)):
        account_prefix = self._get_account_prefix(account)
        require_group = self.account_rules.get(account_prefix).get('require_group')
        if (require_group and (require_group in user_groups)):
            req.environ['swift_owner'] = True
            self.logger.debug(('User    %s    has    admin    and    %s    group.    Authorizing.' % (account_user, require_group)))
            return None
        elif (not require_group):
            req.environ['swift_owner'] = True
            self.logger.debug(('User    %s    has    admin    authorizing.' % account_user))
            return None
    if (req.environ.get('swift_sync_key') and (req.environ['swift_sync_key'] == req.headers.get('x-container-sync-key', None)) and ('x-timestamp' in req.headers)):
        self.logger.debug(('Allow    request    with    container    sync-key:    %s.' % req.environ['swift_sync_key']))
        return None
    if (req.method == 'OPTIONS'):
        self.logger.debug('Allow    OPTIONS    request.')
        return None
    (referrers, groups) = parse_acl(getattr(req, 'acl', None))
    if referrer_allowed(req.referer, referrers):
        if (obj or ('.rlistings' in groups)):
            self.logger.debug(('Allow    authorizing    %s    via    referer    ACL.' % req.referer))
            return None
    for user_group in user_groups:
        if (user_group in groups):
            self.logger.debug(('User    %s    allowed    in    ACL:    %s    authorizing.' % (account_user, user_group)))
            return None
    acct_acls = self.account_acls(req)
    if acct_acls:
        user_group_set = set(user_groups)
        if user_group_set.intersection(acct_acls['admin']):
            req.environ['swift_owner'] = True
            self.logger.debug(('User    %s    allowed    by    X-Account-Access-Control    (admin)' % account_user))
            return None
        if (user_group_set.intersection(acct_acls['read-write']) and (container or (req.method in ('GET', 'HEAD')))):
            self.logger.debug(('User    %s    allowed    by    X-Account-Access-Control    (read-write)' % account_user))
            return None
        if (user_group_set.intersection(acct_acls['read-only']) and (req.method in ('GET', 'HEAD'))):
            self.logger.debug(('User    %s    allowed    by    X-Account-Access-Control    (read-only)' % account_user))
            return None
    return self.denied_response(req)
