protected function initAuthenticator() {
        $auth = $this->auth;
        $this->hmac_validator  = new \Tokenly\HmacAuth\Validator(function($api_token) use ($auth) {
            // lookup the API secrect by $api_token using $this->auth
            $user = $this->user_repository->findByAPIToken($api_token);
            if (!$user) { return null; }

            // populate Guard with the $user
            $auth->setUser($user);

            // the purpose of this function is to look up the secret
            $api_secret = $user->getApiSecretKey();
            return $api_secret;
        });

        $substitions = Config::get('protectedApi.allowedSubstitutions');
        if ($substitions) {
            $this->hmac_validator->setSignedURLValidationFunction(function($actual_url, $signed_url) use ($substitions) {
                return $this->validateSignedURL($actual_url, $signed_url, $substitions);
            });
        }
    }