If the request is marked, allow security checking to be deferred, fixes #3.

This allows for traversal to tile data during the setup phase of z3c forms