code: func InstallValidationHandlers(r *router.Router, base router.MiddlewareChain, rules *validation.RuleSet) {
  	a := auth.Authenticator{
  		Methods: []auth.Method{
  			&server.OAuth2Method{Scopes: []string{server.EmailScope}},
  		},
  	}
  	base = base.Extend(a.GetMiddleware(), func(c *router.Context, next router.Handler) {
  		cc, w := c.Context, c.Writer
  		switch yep, err := isAuthorizedCall(cc, mustFetchCachedSettings(cc)); {
  		case err != nil:
  			errStatus(cc, w, err, http.StatusInternalServerError, "Unable to perform authorization")
  		case !yep:
  			errStatus(cc, w, nil, http.StatusForbidden, "Insufficient authority for validation")
  		default:
  			next(c)
  		}
  	})
  	validation.InstallHandlers(r, base, rules)
  }
docs: // InstallValidationHandlers installs handlers for config validation.
  //
  // It ensures that caller is either the config service itself or a member of a
  // trusted group, both of which are configurable in the appengine app settings.
  // It requires that the hostname, the email of config service and the name of
  // the trusted group have been defined in the appengine app settings page before
  // the installed endpoints are called.