Am 07.12.2016 um 09:07 schrieb Timoses:

Since I want access to /api/* only allowed by logged in users I'm now simply fetching the route with the URLRouter and call the Userman authenticate method. Appears to be working.

This used to be the standard way and is definitely a possibility if
nothing more specific is required. I'll try to upload an example using
the new vibe.web.auth module as soon as I get some time. The
documentation for that module is currently still lacking.