title: Why does HasChildNodes in MvcSiteMap v4 trigger HandleUnauthorizedRequest for each unauthorized node?
body: <p>I'm upgrading from v3 to v4 of MvcSiteMap, and it seems just using the property <code>Html.MvcSiteMap().SiteMap.CurrentNode.HasChildNodes</code> triggers a hit on <code>HandleUnauthorizedRequest</code> in <code>AuthorizeAttribute</code> for every unathorized child node in the list.</p>
  
  <ol>
  <li><p>Why should this happen? I would expect HandleUnauthorizedRequest to be triggered for a separate http request, not just interrogating whether a node exists.</p></li>
  <li><p>What is the best way to distinguish between a 'genuine' unauthorized http request and simply checking an unauthorized sitemap node? My best guess so far is to check whether the controller and action match, but it seems a little unnecessary:</p>
  
  <pre><code>protected override void HandleUnauthorizedRequest(System.Web.Mvc.AuthorizationContext filterContext)
  {
      if (filterContext.HttpContext.Request.IsAuthenticated)
      {
          var httpRouteData = ((MvcHandler)filterContext.HttpContext.CurrentHandler).RequestContext.RouteData;
          var filterRouteData = filterContext.RequestContext.RouteData;
  
          var isHttpRequestUnauth = (httpRouteData.Values["Controller"] == filterRouteData.Values["Controller"] &amp;&amp;
              httpRouteData.Values["Action"] == filterRouteData.Values["Action"]);
  
          if (isHttpRequestUnauth)
              throw new System.Web.HttpException(403, string.Format("Access denied for path '{0}'. ", filterContext.HttpContext.Request.RawUrl));
          else
              base.HandleUnauthorizedRequest(filterContext);
      }
      else
      {
          base.HandleUnauthorizedRequest(filterContext);
      }
  }
  </code></pre></li>
  </ol>