I've been reading some threads here, but I can't really get the grips on whether it's possible and if so, how? I can't follow the answers as I'm a bit of a newcomer in this area.
Mentioned keywords seem to be: @before and Session.

I'd like to serve a serveRestJSClient with UserMan authentication.

I have it working so far as to authenticate the first "layer".
GET /api/Name works. But accessing GET /api/items/me will hang up the application and clot the port.

import userman.api:UserManAPI;
UserManAPI m_api;

@requiresAuth
class API : IAPI
{
    this(UserManAPI api) { m_api = api; }

    // interface class has @anyAuth
    string getName() { return "my name"; }

    IItemAPI m_items;
    this() { m_items = new ItemAPI(); };
    Collection!IItemAPI items() { 
        return Collection!IItemAPI(m_items); }

    import vibe.web.web : noRoute;
    import userman.web: User;
    @noRoute
    User authenticate(HTTPServerRequest req, HTTPServerResponse res)
	{
    	import std.stdio;
        writeln("authenticating");
		return .authenticate(req, res, m_api, "../");
	}
}

class ItemAPI : IItemAPI {
    string getMe() { return "test this";}
}

shared static this() {
    auto router = new URLRouter;

    auto usettings = new UserManSettings;
	usettings.requireAccountValidation = false;
	usettings.databaseURL = "file://./testdb/";
    auto uctrl = createUserManController(usettings);
    UserManAPI uapi = createLocalUserManAPI(uctrl);

    auto restsettings = new RestInterfaceSettings;
	restsettings.baseURL = URL("http://127.0.0.1:8080/api/");
    router.get("/js/api.js", 
        serveRestJSClient!IAPI(restsettings));
	router.registerRestInterface(new API(uapi), restsettings);

    auto settings = new HTTPServerSettings;
    settings.port = 8080;
	settings.bindAddresses = ["::1", "127.0.0.1"];
	settings.sessionStore = new MemorySessionStore;
    listenHTTP(settings, router);
}

Any ideas and inputs are warmly welcome.