If a security module/func is defined in the route of the request that module/func will be called. If the result of that is false it will return a 401 to the requester. Otherwise it will continue to handle the request.