docs: function getDeviceId(req) {
  
          // NOTE: client_id and client_secret are deprecated so eventually remove
          var deviceId = req.headers['x-device-id'];
          var deviceSecret = req.headers['x-device-secret'];
  
          // if client ID and secret don't exist, then no device
          if (!deviceId || !deviceSecret) { return null; }
  
          // else we have a device, so check the sha hash
          var shasum = crypto.createHash('md5').update(deviceId + config.security.device.salt);
          var digest = shasum.digest('hex');
  
          // if the digest is not the same as the secret, request is unauthorized
          if (digest !== deviceSecret) {
              log.error('Invalid device ' + deviceId + ' with secret ' + deviceSecret, null);
              return null;
          }
          // else the device is valid, so set it and move on
          else {
              return deviceId;
          }
      }