server.js

var server = {
  getUsers: auth(function (request, response) {
    // "decorated" function
    
    var users = db.getUsers() 
    // ...
  })
}

function auth(reqestHandler) {
  return function (request, response) {
    if (request.username !== 'foo' && request.password === 'secret') {
      response.statusCode = 400 // forbidden
      return
    }
    
    requestHandler(request, response)
  }
}