# Requirement change

Security wants an access gate in front of everything under `/admin`. A request under `/admin`
without a valid token must be rejected before it reaches the route it was aimed at — no exceptions,
and definitely no partial handling.

There's a second part that's just as important as the rejection itself: we already log every
request that gets served, and legal has been clear that a request that gets rejected must **never
show up in that access log** as if it had gone through. Whatever records "this request was served"
has to run *after* the gate, not before it, so a rejected request simply never reaches it.

To be concrete about the shape of this: two independent pieces of behaviour, applied to the same
requests, that need to compose correctly —
- something that decides whether a request under `/admin` is allowed to continue at all, and
- something that records that a request was served,

and the order they run in, and whether the second one runs at all for a rejected request, is the
whole point.
