Came here wondering how best to solve this myself.

I already subclass the request handler to do client validation (password
etc) and it stuck me that a simpler solution would be to use thread
local storage.

This avoids having to modify dispatch.  The disadvantage is that this
uses a single global scope.  I don't think it's a better solution than
that suggested by samwyse for a final solution, but I thought I'd note
it here because it's a simpler alternative for people needing to add a
work-around, and I suspect many people aren't aware of the possibility.

>>> import _threading_local ; help(_threading_local)

If this wouldn't work (maybe I've misunderstood the server threading?)
then I'd appreciate someone correcting me.  Thanks.