code: def authorize(self, req):
          
          try:
              version, account, container, obj = split_path(req.path, 1, 4, True)
          except ValueError:
              return HTTPNotFound(request=req)
          if not account or not account.startswith(self.reseller_prefix):
              return self.denied_response(req)
          user_groups = (req.remote_user or '').split(',')
          if '.reseller_admin' in user_groups and \
                  account != self.reseller_prefix and \
                  account[len(self.reseller_prefix)] != '.':
              req.environ['swift_owner'] = True
              return None
          if account in user_groups and \
                  (req.method not in ('DELETE', 'PUT') or container):
              # If the user is admin for the account and is not trying to do an
              # account DELETE or PUT...
              req.environ['swift_owner'] = True
              return None
          if (req.environ.get('swift_sync_key') and
              req.environ['swift_sync_key'] ==
                  req.headers.get('x-container-sync-key', None) and
              'x-timestamp' in req.headers and
              (req.remote_addr in self.allowed_sync_hosts or
               get_remote_client(req) in self.allowed_sync_hosts)):
              return None
          referrers, groups = parse_acl(getattr(req, 'acl', None))
          if referrer_allowed(req.referer, referrers):
              if obj or '.rlistings' in groups:
                  return None
              return self.denied_response(req)
          if not req.remote_user:
              return self.denied_response(req)
          for user_group in user_groups:
              if user_group in groups:
                  return None
          return self.denied_response(req)
docs: Returns None if the request is authorized to continue or a standard
          WSGI response callable if not.