better document `before_load`

[s-cork]

Another thing that gave me some pause that you might want to document is the environment the routing methods run in. I'd been going to do an authorization check in a before_load method and force the user to login if they weren't already, but then realized that when they go directly to a URL that probably runs on the server. Sticking a print(is_server_side()) in before_load it looks like the initial run is on the server, and then another happens on the client.

I'm assuming the best practice is to redirect in before_load, rather than do anything that relies on the client-side environment.

Originally posted by @jshaffstall in #29 (comment)