docs: function auth(app, config) {
    /* Ensure authorizer */
    if (is.not.function(config.authorizer)) {
      throw new Error(ERR_AUTHORIZER);
    }
  
    /* Check debug type */
    if (is.function(config.debug)) {
      debug = config.debug;
    } else if (config.debug) {
      debug = console.log.bind(console);
    }
  
    /* Set the authorized property in 'req.session' */
    app.use((req, res, next) => {
      req.session.authorized = config.authorizer(req);
      next();
    });
  
    /* Set authorization rules for each route */
    config.routes.forEach((route) => {
      route = normalize(route);
  
      var router = app.route(route.path);
  
      if (is.array(route.method) && route.method.length) {
        route.method.forEach((method) => {
          logAssignment(method, route.path, route.allows);
          router[method](generate(route.allows), authorize);
        });
      } else if (is.string(route.method)) {
        logAssignment(route.method, route.path, route.allows);
        router[route.method](generate(route.allows), authorize);
      } else {
        logAssignment(ALL, route.path, route.allows);
        router.all(generate(route.allows), authorize);
      }
    });
  }