API design for tornado guard #1

This issue represents a discussion on the api design for tornadoapi-guard.

The below issues will give some context on why tornado doesn't have a middleware or extension plugin api:

• tornado extensions tornadoweb/tornado#2849
• Middleware for tornado? tornadoweb/tornado#49
• Tornado Middleware tornadoweb/tornado#679

This is a quote from one of the main maintainers of tornado (@ploxiln):

Tornado tends more towards a parts-you-can-use structure. You can make (and distribute) custom Router class, custom RequestHandler subclass, custom httpserver class, custom httpclient class, or a library that's convenient to use with an existing tornado usage pattern. Examples:

https://github.com/bdarnell/tornado_http2
https://www.tornadoweb.org/en/stable/routing.html
https://github.com/siddhantgoel/streaming-form-data/blob/master/examples/tornado/stream_request_body.py

You can also use the mixin pattern, just pass it any subclasses you are extending e.g

class BaseHandler(
    # Add Request middleware here 
    TornadoAuthSessionMixin,
    tornado.web.RequestHandler,
):
    pass