You can't send the headers unless you know if the person is authorized or not (and other common things you check in the before filters). So yes, this stuff would have to be checked before rendering a view.