Shopify App Template (CLI 3) with provided billing api workshop is unsecure?

How will be the proper way to make a limited access to the application? I’m thinking about creating a middleware as

app.use(“/api/*”, shopify.validateAuthenticatedSession())

but with the code that checks the billing.

Do you know a better way?