I'm developing a REST API in python with tornado and I'm going to implement the authentication and authorization, trying to avoid lock-in to other big projects i.e django. I'm looking around through forums and SO too and I've fond a solution that could fit: repoze.who/what. It seems a good solution but I'm a bit scared about the activity of the projects (repoze.what last release seems to be 1.0.9 (2010-03-04)) and if it can work with async IO.
Anyone have tried it and/or knows something else?