put the following in your db.py model (or any other)

import os.path
if not auth.is_logged_in() and db(db.auth_user.id>0).count() and not os.path.exists(os.path.join(request.folder, 'LOCK')) and (request.env.remote_addr in '127.0.0.1 localhost'.split()):
    from gluon.storage import Storage
    user = db(db.auth_user.id==1).select().first()
    auth.user = Storage(auth.settings.table_user._filter_fields(user, id=True))
    auth.environment.session.auth = Storage(user=user, last_visit=request.now,
                                            expiration=auth.settings.expiration)
    response.flash = 'You were automatically logged in as %s %s.<br/> To prevent this create the file %s'%(user.first_name, user.last_name, os.path.join(request.folder, 'LOCK'))

You will be automatically logged in as the first user if you call your web2py app from localhost or 127.0.0.1 you can prevent this behavior by creating a file called LOCK in your application root directory