The directive registers a JavaScript handler in the access phase,
running after built-in access checkers (allow/deny, auth_basic,
auth_request). r.subrequest(), ngx.fetch() and other async operations
are supported.
The handler defaults to NGX_OK (access granted) on normal completion,
matching the behavior of other access phase modules. The r.decline()
method allows the handler to return NGX_DECLINED (no opinion), deferring
the decision to other access checkers under "satisfy any".
The r.return() method can send any HTTP response from the access phase,
including 3xx redirects for authentication flows.