The request object contains preprocessed information about the request headers. Most of them are available via request.environ -- under their own name (for CGI-variables) or with an HTTP_ prefix; case can be normalized, - is typically replaced by _. Others have special access, e.g. AUTHORIZATION is avaiiable as request._auth. Some plugins might delete this attribute.