lib.auth.__init__.py:get_user()
The get_user() function first checks the request.environ environment dictionary to discover whether the _auth_user_environ_key (AUTH_USER) is bound. If it is, the bound value is returned. Otherwise, it checks the session to discover whether the _auth_user_session_key (AUTH_USER_ID) is bound and if so, returns that bound value.
If all else fails, None is returned, signifying that the check was not successful.
Either way, a value is returned to SignedIn() and then up the calling chain to the @authorize() decorator.