auth.go
func (h AuthHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	valid, entity, err := h.authenticate(r)
	if err != nil {
		h.error(w, r, err)
		return
	}
	if h.PostAuthFunc != nil {
		rr, err := h.PostAuthFunc(w, r, valid, entity)
		if err != nil {
			h.error(w, r, err)
			return
		}
		if rr != nil {
			r = rr
		}
	}
	if !valid {
		h.unauthorized(w, r)
		return
	}

	if h.Handler != nil {
		h.Handler.ServeHTTP(w, r)
	}
}
func (h AuthHandler) ServeHTTP(w http.ResponseWriter, r *http.Request) {
	valid, entity, err := h.authenticate(r)
	if err != nil {
		h.error(w, r, err)
		return
	}
	if h.PostAuthFunc != nil {
		rr, err := h.PostAuthFunc(w, r, valid, entity)
		if err != nil {
			h.error(w, r, err)
			return
		}
		if rr != nil {
			r = rr
		}
	}
	if !valid {
		h.unauthorized(w, r)
		return
	}

	if h.Handler != nil {
		h.Handler.ServeHTTP(w, r)
	}
}
// ServeHTTP serves an HTTP response for a request.