Documentation is missing for the validation path referenced in the dev config

I am trying to evaluate Athens for a project, I noticed that there is a [validation hook](
https://github.com/gomods/athens/blob/master/config.dev.toml#L84) in the default configuration but there is no details on what this is, means or how it is used.

My thought is that by using this, I can create a system that allows me to somehow identify the source of who is requesting a module (for example: a private module attempted to be downloaded by an attacker who does not normally have access) and prevent them from accessing things they should not be allowed to access.

Start at config.dev.toml line 84, where the validation hook is referenced. Trace how that configuration entry is used, then document what the hook is, what it means, and how it can be used to identify or restrict module requests. Done means the validation path and its access-control implications are explained for someone evaluating Athens.

Written by the indexing model from the issue text.