public function onConstruct()
    {
        //early return on OPTIONS calls in dev, so they follow the correct spec and don't die for missing credentials
        if ($this->request->getMethod() == 'OPTIONS' && APPLICATION_ENV != 'production') {
            return;
        }

        $config = $this->getDI()->get('config');
        $auth = $this->getDI()->get('auth');

        switch ($config['security']) {
            case true:
                $token = $this->getAuthToken();

                // check for a valid session
                if ($auth->isLoggedIn($token)) {
                    // continue
                } else {
                    throw new HTTPException('Unauthorized, please authenticate first.', 401, [
                        'dev' => 'Must be authenticated to access.',
                        'code' => '30945680384502037'
                    ]);
                }
                break;

            case false:
                // if security is off, then create a fake user profile to trick the api
                // todo figure out a way to do this w/o this assumption
                // notice the specific requirement to a client application
                if ($auth->isLoggedIn('HACKYHACKERSON')) {
                    // continue
                } else {
                    throw new HTTPException('Security False is not loading a valid user.', 401, [
                        'dev' => 'The authenticator isn\'t loading a valid user.',
                        'code' => '23749873490704'
                    ]);
                }
                break;

            default:
                throw new HTTPException('Bad security value supplied', 500, ['code' => '280273409724075']);
                break;
        }

        // continue after security is worked out
        parent::onConstruct();
    }