objects with the ID 'REQUEST'.

Added support for getPhysicalRoot method, which is actually acquired
from the top-level object. We actually set the attribute to
Acquisition.Acquired to make sure.  We also provide a security setting
that makes it callable only from Python.

Added unrestrictedTraverse, which does publisher-style traversal
(__bobo_traverse__, getattr, getitem) without security checks.
Provide a setting that makes it private.