we don't need to check the value for 'web'? is it valid to have a customization for something other than web, say if someone created their own security manager?

just guessing, don't shoot me ;)