One common piece of user feedback from the TurboGears 1 community:
Authentication and Authorization are somewhat too closely tied by identity.
At the same time, it was very, very nice to be able to offer people an out of the box solution to their total auth needs, and most brand-new web-application projects use a [...]