def authorize!(*accepted_groups) #:doc:
      begin

        # an authenticated user must exist.
        unless logged_in?

          store_location

          if (auth_url = ::Incline::UserManager.begin_external_authentication(request))
            ::Incline::Log.debug 'Redirecting for external authentication.'
            redirect_to auth_url
            return false
          end

          raise_not_logged_in "You need to login to access '#{request.fullpath}'.",
                              'nobody is logged in'
        end

        if system_admin?
          log_authorize_success 'user is system admin'
        else
          # clean up the group list.
          accepted_groups ||= []
          accepted_groups.flatten!
          accepted_groups.delete false
          accepted_groups.delete ''

          if accepted_groups.include?(true)
            # group_list contains "true" so only a system admin may continue.
            raise_authorize_failure "Your are not authorized to access '#{request.fullpath}'.",
                                      'requires system administrator'

          elsif accepted_groups.blank?
            # group_list is empty or contained nothing but empty strings and boolean false.
            # everyone can continue.
            log_authorize_success 'only requires authenticated user'

          else
            # the group list contains one or more authorized groups.
            # we want them to all be uppercase strings.
            accepted_groups = accepted_groups.map{|v| v.to_s.upcase}.sort
            result = current_user.has_any_group?(*accepted_groups)
            unless result
              raise_authorize_failure "You are not authorized to access '#{request.fullpath}'.",
                                      "requires one of: #{accepted_groups.inspect}"
            end
            log_authorize_success "user has #{result.inspect}"
          end
        end

      rescue ::Incline::NotAuthorized => err
        flash[:danger] = err.message
        redirect_to main_app.root_url
        return false
      end
      true

    end
def authorize!(*accepted_groups) #:doc:
      begin

        # an authenticated user must exist.
        unless logged_in?

          store_location

          if (auth_url = ::Incline::UserManager.begin_external_authentication(request))
            ::Incline::Log.debug 'Redirecting for external authentication.'
            redirect_to auth_url
            return false
          end

          raise_not_logged_in "You need to login to access '#{request.fullpath}'.",
                              'nobody is logged in'
        end

        if system_admin?
          log_authorize_success 'user is system admin'
        else
          # clean up the group list.
          accepted_groups ||= []
          accepted_groups.flatten!
          accepted_groups.delete false
          accepted_groups.delete ''

          if accepted_groups.include?(true)
            # group_list contains "true" so only a system admin may continue.
            raise_authorize_failure "Your are not authorized to access '#{request.fullpath}'.",
                                      'requires system administrator'

          elsif accepted_groups.blank?
            # group_list is empty or contained nothing but empty strings and boolean false.
            # everyone can continue.
            log_authorize_success 'only requires authenticated user'

          else
            # the group list contains one or more authorized groups.
            # we want them to all be uppercase strings.
            accepted_groups = accepted_groups.map{|v| v.to_s.upcase}.sort
            result = current_user.has_any_group?(*accepted_groups)
            unless result
              raise_authorize_failure "You are not authorized to access '#{request.fullpath}'.",
                                      "requires one of: #{accepted_groups.inspect}"
            end
            log_authorize_success "user has #{result.inspect}"
          end
        end

      rescue ::Incline::NotAuthorized => err
        flash[:danger] = err.message
        redirect_to main_app.root_url
        return false
      end
      true

    end
Authorizes access for the action.

 * With no arguments, this will validate that a user is currently logged in, but does not check their permission.
 * With an argument of true, this will validate that the user currently logged in is an administrator.
 * With one or more strings, this will validate that the user currently logged in has at least one or more
   of the named permissions.

     authorize!
     authorize! true
     authorize! "Safety Manager", "HR Manager"

 If no user is logged in, then the user will be redirected to the login page and the method will return false.
 If a user is logged in, but is not authorized, then the user will be redirected to the home page and the method
 will return false.
 If the user is authorized, the method will return true.