I looked into it recently. Apparently it has session based auth.

I tried to figure out how to do the first thing that came to mind: on an incoming request, check that the user is authenticated, and if not redirect them to a login page with a ?next= parameter to be redirected back to after login.

Couldn't find a way to do it. In Django you use the @login_required decorator on a view and that's it.