If I have some routes, like /user/:id/foo and /user/:id/bar, and I’d like to be able to throw a 401 for both routes, what would be the idiomatic way of doing it in Yada?

Ah, I guess it’s in the docs 🙂 https://github.com/juxt/yada/blob/master/doc/security.adoc

Yes. And see https://juxt.pro/blog/posts/yada-authentication.html @grav