/// <summary>
        /// POST /api/employees
        /// </summary>
        /// <param name="data"></param>
        /// <returns></returns>
        public HttpResponseMessage Post(EmployeeModel model)
        {
            var context = this.DbContext;

            if (!this.User.CanCreate<Employee>())
            {
                throw new HttpResponseException(new HttpResponseMessage(HttpStatusCode.Forbidden));
            }

            // transform the EmployeeModel to Employee
            var entity = model.TransformTo<Employee>();

            // update Manager property
            if (entity.Manager == null
                || entity.Manager.Id != model.ManagerId)
            {
                entity.Manager = context.Employees.Find(model.ManagerId);
            }

            // add the entity
            context.Employees.Add(entity);

            // persist changes to the database
            context.SaveChanges();

            // fire the web event
            new EmployeeCreatedEvent(entity).Raise();

            // create response
            var response = Request.CreateResponse<EmployeeModel>(HttpStatusCode.Created, selector(entity));
            string uri = Url.Link("Api", new { id = entity.Id });
            response.Headers.Location = new Uri(uri);
            return response;
        }