I’ve ended up with required (doesn’t fall through)...

# ktor

[mp]

I’ve ended up with required (doesn’t fall through) vs optional (does) variants of authn methods that are then composed appropriately given the situation so that the endpoint logic doesn’t have to unnecessarily do its own validation.