decided to also include the `app.security` check here. It isn't required, but it'll avoid common errors when people use this as a parent template of error pages or when they don't cover each page in a firewall.