HTTP INPUT (do we want HTTPS integrated into the Go app or do we use nginx up front? It may not matter if we're using Docker to deploy. Whether we integrate nginx into the container or use HTTPS in Go. I don't know whether Go or nginx would be more secure. I would think nginx is more robust and would be patched faster. )
Create log entry. Get start time for request and store
Open a database connection and store in request context? Probably need a connection pool.
Inspect access token/Bearer header. If token, check if valid and get the user object and store it in context. If not, store that we're not authenticated
Hit top-level router. All routes w/o access token requirement go first. Think /auth/token, /auth/resetPassword type of stuff. Would also include oauth2 callback routes. The else case will be a secondary router which requires authentication. This router will have the real REST application routes.
Ideas? Improvements? Total miss?