Since this method is invoked by the next one, should this one instead have the authorization enabled check so both methods get that?  Currently this method doesn't validate that security is enabled or not.