...
[11:34:18 CDT(-0500)] <EricDalquist> modify the url syntax provider to generate the request info object without doing permission checks
[11:34:29 CDT(-0500)] <EricDalquist> then filter that object using permission checks
[11:34:36 CDT(-0500)] <EricDalquist> and if they are different
[11:34:41 CDT(-0500)] <EricDalquist> you know you need to auth
[11:35:02 CDT(-0500)] <EricDalquist> right now the permission filtering happens while the request info object is being built
[11:35:17 CDT(-0500)] <EricDalquist> so you never have access to an object model of the actual original url