Once the under() sub is compiled, all following get() and post() etc calls get compiled as calling this under() sub first.

So

under sub { validate_cookie() };
get "/foo" => sub {
    my $c = shift;
    ...
};
get "/bar" => sub {
    my $c = shift;
    ...
};
[download]

is equivalent to

get "/foo" => sub {
    validate_cookie() or return;
    my $c = shift;
    ...
};
get "/bar" => sub {
    validate_cookie() or return;
    my $c = shift;
    ...
};
[download]