         ##
         stop: (done)->
             @_changeStatus 'shutdown'
-                        
+
             @_init 'stop', 'stopped', done
 
-        
+
         ##
         ##
         ##
         lookup: (name, identity, done)->
+            if !done && typeof identity is 'function'
+                done = identity
+                identity = @identity
+
             if !identity || !identity.id || !identity.token
                 return done new Error '2. parameter is not identity'
-            
+
             ## myself
             if name is @id
                 @logger.debug 'found(%s) for %s', @ID, identity.id
                 return @forIdentity identity, done
-            
+
             ## children
             if (base = name.split('.').shift()) is @id
                 base = (name = name.substr base.length + 1).split('.').shift()
-            
-            for child in @children 
+
+            for child in @children
                 if child.id is base
                     @logger.debug 'delegate lookup(%s) to child %s for %s', name, child.ID, identity.id
                     return child.lookup name, identity, done
-            
+
             ## parent
             if @parent?.lookup
                 @logger.debug 'delegate lookup(%s) to parent %s for %s', name, @parent.ID, identity.id
                 return @parent.lookup name, identity, done
-            
+
             ## global
             if floyd.__parent?.lookup
                 @logger.debug 'delegate lookup(%s) to global parent for %s', name, identity.id
                 return floyd.__parent.lookup name, identity, done
-            
+
             ## not found
             @logger.debug 'lookup(%s) failed for %s', name, identity.id
             done new Error 'Context not found: '+name
-            
-        
+
+
         ##
         ## delegates a method call down the hirarchy
         ## propagates errors if the last value in args is a fn

            else
                @__CTXID ?= 0
                'ctx'+(@__CTXID++)
    
        ##
        ## base configuration
        ##
        configure: (config)->
        
            if typeof config is 'string'
                config = new floyd.Config floyd.tools.objects.resolve config

            config.id ?= @__ctxID()
            
            config.type ?= 'floyd.Context'
            
            if hostconfig = config.hostconfig?[floyd.system.hostname]

                if typeof hostconfig is 'function'
                    hostconfig.apply @, [config]
                else
                    floyd.tools.objects.extend config, hostconfig
            
            config = new floyd.Config config
            
            # extend context with methods from config. add @method._super for each
            for key, value of config
                do(key, value)=>
                    if typeof value is 'function'

                        _orig_super = @[key]
                                    
                        @[key] = (args...)=>
                            value.apply @, args
                        
                        if _orig_super 
                            @[key]._super = (args...)=> 
                                #console.log 'calling _orig_super for', key, _orig_super.toString()
                                _orig_super.apply @, args
                                    
            
            ##
            ##         
            floyd.tools.objects.intercept @, 'destroy', (done, destroy)=>

                if @stop && @_status.indexOf('stopped') is -1
                    @logger.warning 'context not stopped!'
                
                @_init 'destroy', null, (err)=>
                    done?(err) if err
                    
                    if !destroy
                        done?()
                    
                    else
                    
                        destroy (err)=>
                        
                            @_changeStatus 'destroyed'
                            
                            done? err
            
            ##
            ##
            if manager = config.data.authManager
                
                #console.log 'prepare _createAuthHandler', manager
                
                if config.TOKEN
                    floyd.tools.objects.intercept @, 'boot', (done, boot)=>
                        
                        first = true
                        @_getAuthManager().authorize config.TOKEN, (err)=>
                            #return done(err) if err
                            
                            if first 
                                first = false
                                boot done
                
                ##
                @_createAuthHandler = ()=>
                    
                    #console.log '_createAuthHandler', manager
                    
                    _auth = (fn)=>
                        # EXPERIMENTAL shortcut. use child if found
                        # re-think implications of unprotected usage
                         
                        if (ctx = @children[manager]) 
                            fn null, ctx
                        
                        else 
                            @lookup manager, @identity, (err, ctx)=>
                                if !ctx && config.ORIGIN
                                    @lookup config.ORIGIN+'.'+manager, @identity, fn
                                
                                else
                                    fn err, ctx
                    
                    new floyd.auth.Handler

                        ##

                                do(check)=>
                                    checks.push (next)=>
                                        check.apply @, [identity, key, args, next]


                        next true

                ,

                    (next)=> # check for general remote restriction

                        next (@permissions?[key] || @permissions) isnt false

                ,

                    (next)=> # custom check function - must callback true to permit!
                        if typeof (check = @permissions) is 'function' || typeof (check = @permissions?[key]) is 'function' || check = (@permissions?[key]?.check || @permissions?.check)

                            check identity, key, args, next

                        else next true

                ,

                    (next)=> # check for identity.id restriction

                        if id = (@permissions?[key]?.identity || @permissions?.identity)
                            next identity.id is id

                        else next true
                ,

                    (next)=> # check for token restriction

                        if token = (@permissions?[key]?.token || @permissions?.token)

                            identity.token (err, _token)=>
                                next token is _token

                        else next true
                ,

                    (next)=> # check for login restriction

                        if (@permissions?[key]?.login || @permissions?.login)

                            identity.login (err, login)=>
                                next !!login

                        else next true
                ,

                     (next)=> # check for user restriction and test identity.login

                        if user = (@permissions?[key]?.user || @permissions?.user)

                            identity.login (err, login)=>
                                next login is user

                        else next true
                ,

                    (next)=> # check for roles restriction and test identity.hasRole
                        if roles = (@permissions?[key]?.roles || @permissions?.roles)

                            identity.hasRole roles, (err, ok)=>
                                next ok

                        else next true

                ]

                permit = (ok)=>
                    return fn(new floyd.error.Forbidden @ID+'.'+key) if !ok

                    if check = checks.shift()
                        check permit

                    else fn()

                # start recursion

                permit true

        ##
