(defn wrap-throw-auth [handler]
  (fn [req]
    (when (not (authenticated? req))
      (throw-unauthorized req)
      (handler req))))

the middleware defined in router is applied only if a path is matched. the middleware in ring-handler wraps the whole app, so applies to path misses too.

I use :middleware in the ring-handler to set a bunch of configuration (coming from donut system) on the request, so that these configuration options are available to every route. It's really nifty!

ah thanks