Why is identity forced to be string?

The module-level function, `remember()` asserts that the identity is a string:

```python
assert isinstance(identity, str), identity
assert identity
```

Shouldn't that be the burden of the underlying implementation of an IdentityPolicy?

My use-case: I'm building a custom IdentityPolicy and associated AuthorizationPolicy that sends a JWT token back to the client with a custom header. In my user-session code I want to be able to do, e.g.:

```python
def login(request):
# Get `username` and `password` from request data, validate, etc.
username, password = ...
# Using an underlying model, User, call a classmethod `login` which
# validates the credentials and returns a user instance on success; None on failure
user = User.login(username, password)
if user is None:
raise web.HTTPUnauthorized()
# I have a valid, logged in user, json-ify the object and set header
resp = web.json_response(user)
remember(request, resp, user) # <== BLOWS UP WITH ASSERTION ERROR
return resp
```

The implementation of my policies expects a User instance in all places an identity is passed around. When creating the JWT the state of the user instance dictates the claims made. I want this logic in the IdentityPolicy not in the caller.

It seems to me that at the API level identities should be opaque and leave serialization/validation up to the underlying policy implementations.