Auth checking occurs before the request handler is called, using the token in the Authorization header, so no further checking should be needed from these handlers. If the client has the right token, we assume they are good to go.