maybe we can extent this a little bit, also noting that this doesn't work for routing error pages, as routing is done *before* the security?