Getting AutKit to work more like TG Identity

One of the things I have been struggling with on Pylons is the support for AuthKit. TuboGears has such a great framework call identity. AuthKit is under heavy development which might be part of the reason I am having so much trouble. However I think as part of the Pylons community we need to come up with a standard solution that has standard implementations. One of the main things is being able to ask the framework if a user is in a group.
u = get_user()
u.has_role('admin') or u.in_group('admin')

This user object needs to be accessible any where in the application. Right now I am working on placing the object in the namespace of my templates. A lot UI is based on roles that a user has. The current implementation would end up working something like this.

import authkit

class AppUser(authkit.AuthUser):
"""
The AuthUser would have has_role, authenticated ect.
Also you could override the password verification methods and all that
instead of plugging it into globals somewhere.
"""

def __init__(self):
authkit.AuthUser._init__(self)
self.roles = ['some list, property, or function call']

AuthKit has some classes that provide some amount of support for this but I think my solution would be much easier to use in templates.