title: Pyramid authorization being bypassed
body: <p>I have just added authorization to my pyramid application according to <a href="http://docs.pylonsproject.org/projects/pyramid/en/latest/tutorials/wiki2/authorization.html#seeing-our-changes" rel="nofollow noreferrer">the docs</a>.  At this time the app only displays info.</p>
  
  <p>I will also obtain my login information from MySQL, so I have implemented something similar to <a href="https://stackoverflow.com/questions/9171519/using-pyramid-authentication-with-pyramid">this</a>.  </p>
  
  <p>However, its not quite working as it should, and I don't know how to fix it:  </p>
  
  <p>After I logout, I can bypass the entire login by just entering the target page URL. It seems to me that its not 'forgetting' the login.  It also does not redirect to the login page when I enter the url directly.</p>
  
  <p>Here is my <code>views.py:</code></p>
  
  <p><strong>target page:</strong></p>
  
  <pre><code>@view_config(route_name='monitor', 
          renderer='monitor:templates/monitor.mak', 
          permission='view'
          )
  def monitor(request):
  
      oEntry_Logins = DBSession.query(Login).order_by(Login.id)
      oEntry_Alerts = DBSession.query(Alert).order_by(Alert.id)
  
      return {
                  'oEntry_Logins' : oEntry_Logins,
                  'oEntry_Alerts'   : oEntry_Alerts,
                  'logged_in' : request.authenticated_userid,
          }
  </code></pre>
  
  <p><strong>login/logout:</strong></p>
  
  <pre><code>@view_config(route_name='login', renderer='templates/login.pt')
  @forbidden_view_config(renderer='templates/login.pt')
  def login(request):
  
  
      login_url = request.route_url('login')
      referrer = request.url
      if referrer == login_url:
          referrer = '/' # never use the login form itself as came_from
      came_from = request.params.get('came_from', referrer)
      message = ''
      login = ''
      password = ''
      if 'form.submitted' in request.params:
          login = request.params['login']
          password = request.params['password']
  
          user = DBSession.query(User).filter(login==User.name).filter(password==User.password).count()  #DBSession
          if(user != 0):  #DBSession
  
              headers = remember(request, login)
              return HTTPFound(location = came_from,
                              headers = headers)
          message = 'Failed login'
  
      return dict(
          message = message,
          url = request.application_url + '/login',
          came_from = came_from,
          login = login,
          password = password,
          )
  
  #logout view
  @view_config(route_name='logout')
  def logout(self):
  
      request = self.request
  
      headers = forget(request)
      return HTTPFound(location = request.route_url('login'),
                      headers = headers)
  </code></pre>
  
  <p><strong>and here is my models file:</strong>  </p>
  
  <pre><code>...
  class RootFactory(object):
      __acl__ = [ (Allow, Everyone, 'view'),
                  (Allow, 'group:editors', 'edit') ]
      def __init__(self, request):
          pass
  </code></pre>
  
  <p><strong>and my security.py file:</strong></p>
  
  <pre><code>from .models import (
      DBSession,
      User,
      )
  
  def groupfinder(userid, request): 
      session = DBSession()
      for instance in session.query(User).filter(User.name==userid):
  
          group = 'group:'  #all are simply part of the same group
          lsth = {'userid':[group]}
      return lsth.get  ('userid')  
  </code></pre>
  
  <p>At the moment, for testing purposes, the passwords are still stored as plaintext in a mysql database.</p>
  
  <p>How do I make this code work as it should?</p>