         return res.status(404).send(error: err.toString()) if err
         return res.status(404).send(error: "Model not found with id: #{req.params.id}") unless json
         json = _.pick(json, @white_lists.show) if @white_lists.show
-        return res.json(json) unless @render
 
-        # TODO: intgrate the cache -> would need to be done as part of the fetch
         @render req, json, (err, json) =>
           return res.status(500).send(error: err.toString()) if err
           res.json(json)

    catch err
      res.status(500).send(error: err.toString())


# TODO: allow for external caller to set CORS
# # allow cross-origin
# app.all route, (req, res, next) ->
#   res.set('Access-Control-Allow-Origin', bind_options.origins)
#   res.set('Access-Control-Allow-Headers', 'X-Requested-With,CONTENT-TYPE')
#   res.set('Access-Control-Allow-Methods', 'GET,POST,PUT')
#   next()
# app.all "#{route}/:id", (req, res, next) ->
#   res.set('Access-Control-Allow-Origin', bind_options.origins)
#   res.set('Access-Control-Allow-Headers', 'X-Requested-With,CONTENT-TYPE')
#   res.set('Access-Control-Allow-Methods', 'GET,PUT,DELETE')
#   next()
#   _enableCors: (app, url) =>
#     app.all url, (req, res, next) ->
#       res.set 'Access-Control-Allow-Origin', cors.origins if cors.origins
#       res.header 'Access-Control-Allow-Headers', 'X-Requested-With,Content-Disposition,Content-Type,Content-Description,Content-Range'
#       res.header 'Access-Control-Allow-Methods', 'HEAD, GET, POST, PUT, DELETE, OPTIONS'
#       res.header('Access-Control-Allow-Credentials', 'true')
#       next()

  constructor: (app, options={}) ->
    @[key] = value for key, value of options
    @white_lists or= {}
    @views or= {}

    if @auth
      app.get "#{@route}/:id", @auth, @show
