Your HttpChild.requestHandler method gets first bite at the apple, so to speak.
You can inspect the req and res objects there and do any security checks, etc. If you return, normal processing occurs.
We talked about using this hook to switch Config.documentRoot based upon the req.host value (vhost!). You can examine req.uri and do some security checks as well. If you call res.stop(), no further processing by the normal request handler will be done.
So you could:
res.status = 403;
res.write('Forbidden');
res.stop();
in your requestHandler if you want to deny access.
You can dump the req, res, or any other object with:
console.dir(req);
console.dir(res);
console.dir(some_object);