for other stuff, like dealing with users, and private information, I look at authentication, etc when processing the request