docs: function onStorePreAuth (request, reply) {
    var server = request.connection.server
  
    // PouchDB’s replication sends an initial GET to CouchDB root initially
    var isGetRootPath = request.path === '/hoodie/store/api/' && request.method === 'get'
    if (isGetRootPath) {
      return reply.continue()
    }
  
    // check if store is publically accessable
    var storePath = request.path.substr('/hoodie/store/api/'.length)
    var dbPath = storePath.split('/')[0]
    var dbName = decodeURIComponent(dbPath)
    var requiredAccess = isRead(request) ? 'read' : 'write'
  
    return server.plugins.store.api.hasAccess(dbName, {
      access: requiredAccess
    })
  
    .then(function (hasAccess) {
      if (hasAccess) {
        return reply.continue()
      }
  
      var sessionToken = toSessionToken(request)
      if (!sessionToken) {
        return reply(Boom.unauthorized())
      }
  
      return server.plugins.account.api.sessions.find(sessionToken)
  
      // we have to nest the .then callback here because of the `return`
      // statements above. If we would chain the .then below outside of this
      // `.then`, then it would be executed after the two `return` statements
      // above and cause `reply` to be called twice
      .then(function (session) {
        delete request.headers.authorization
        request.headers.cookie = 'AuthSession=' + session.id
  
        var roles = session.account.roles.concat('id:' + session.account.id, 'user')
  
        return server.plugins.store.api.hasAccess(dbName, {
          access: requiredAccess,
          role: roles
        })
  
        .then(function (hasAccess) {
          if (hasAccess) {
            return reply.continue()
          }
  
          reply(Boom.unauthorized())
        })
      })
    })
  
    .catch(function (error) {
      if (error.status === 404) { // session not found
        return reply(Boom.unauthorized())
      }
  
      server.log(['store', 'error'], error.message)
      reply(Boom.wrap(error, 500))
    })
  }