A decorator to protect views with Negotiate authentication.

def require_user(self, *users, user=None):
        """A decorator to protect views with Negotiate authentication."""

        # accept old-style single user keyword-argument as well
        if user:
            users = (*users, user)

        def _require_auth(view_func):
            @wraps(view_func)
            def wrapper(*args, **kwargs):
                """ Effective wrapper """
                username, out_token = self.authenticate()
                if username and out_token:
                    b64_token = base64.b64encode(out_token).decode('utf-8')
                    auth_data = 'Negotiate {0}'.format(b64_token)
                    if not users or username in users:
                        response = make_response(view_func(*args,
                                                           username=username,
                                                           **kwargs))
                    else:
                        response = Response(status=403)
                    response.headers['WWW-Authenticate'] = auth_data
                    return response
                return Response(
                    status=401,
                    headers={'WWW-Authenticate': 'Negotiate'},
                )

            return wrapper
        return _require_auth