Greetings! And paraphrasing a famous quote: For those about to web (with Mojolicious) - we salute you!

First of all, as of common good practices of programming, you should avoid duplicate code. You have three chunks in your code that do the same thing - shows "401 unauthorised" and do some logging about it. So, make it in one place. Like this:

helper deny_with_message => sub {
  my $self = shift;
  my $message = shift;
  $self->app->log->warn($message);
  $self->render(
    status => 401,
    text   => 'unauthorized',
  );
};
[download]

And then you could invoke it like this:

And then about under... People already told you to use under, I could only support this in some usual cases, though, in my opinion, in your particular case using under will not make your code readable or more logical - it will be sugar for sugar. Using under is great when you have usual web application with login page and many many pages that is under one and the same check (like, "do we have a cookie?"). Your case is different - there's one page that checks IP, login and password, and another page that checks session cookie. So you'll have to use two under subs which, again, will not make your code ligher or more readable.

I'm using under myself, both in session-cookie-based apps and in JWT-based apps, and it's great in apps with whole lot of pages that could be viewed after one same check, but I'm doubt that your code will be better if you rewrite your app with under. So just refactor your code to not repeat itself and you'll be fine.

P.S.: If you're didn't saw this already, I recommend you to see Mojocasts.