Called for every inbound request. Returns the auth scope for the caller, or null/undefined if the request must be rejected with 401.
Called for every inbound request. Returns the auth scope for the caller, or null/undefined if the request must be rejected with 401.