Refactored routing to ensure the security module is called first in all cases (previously it would be called after verifying a user was logged in which, unless the user hit a static resource, would put them in a bad spot and not be able to login).