r.always will always match. You shouldn't be able to call it directly as it is private. You can use r.on without arguments without arguments for the same effect.
Note that probably isn't what you want. Because r.always or r.on without arguments will always yield to the block, execution will not continue past that. So your r.get 'faz' code will never be reached.
A better approach in your case would be to have r.get 'faz' first, then the permission check, then the other two routes. However, with more complicated routes, that's not always possible. Having a separate segment for the paths that need different permissions works well for that if it is possible. Otherwise, you can do the permission check separately in both the bar and baz routes.