I like this idea. It lines up more with the idea of a ```bastion```. I'll adjust the docs and semantics to match this.

There's a caveat, though - I want to make it clear that this middleware should not be used as a security measure, e.g., security through obscurity. What ```bastion``` would prevent is accessing a given endpoint through standard means ```api.example.com/v1/health```.