public function startup(Controller $controller) {
        $handled = ($this->_handled === array('*') || in_array($controller->action, $this->_handled));

        if ($handled && !$controller->request->is('ajax')) {
            if (isset($controller->Security)) {
                $controller->Security->blackHole($controller, 'You are not authorized to process this request.');
            } else {
                $controller->redirect(null, 401, true);
            }
        }

        $this->controller = $controller;
    }