	public function __construct()
	{
		parent::__construct();
		
		// Load profiler
		if (Kohana::config('config.enable_profiler'))
		{
			$this->profiler = new Profiler;
		}
		
		$this->auth = Auth::instance();
		
		$this->db = Database::instance();

		// Are we logged in? if not, do we have an auto-login cookie?
		if (! $this->auth->logged_in()) {
			// Try to login with 'remember me' token
			if (! $this->auth->auto_login())
			{
				// Login user in via HTTP AUTH
				$this->auth->http_auth_login();
			}
		}

		// Get session information
		$this->user = Auth::instance()->get_user();

		// Check private deployment access
		$controller_whitelist = array(
			'login',
			'riverid',
			'api'
		);

		if (Kohana::config('settings.private_deployment'))
		{
			if (!$this->auth->logged_in('login') AND ! in_array(Router::$controller, $controller_whitelist))
			{
				// Redirect to login form
				url::redirect('login');
			}
		}
		
		// Set default content-type header
		header('Content-type: text/html; charset=UTF-8');
	}
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.