how does vibe's PrivateAccessProxy work

[yawniek via Digitalmars-d-learn]

can someone explain a bit how the @before hooks works in detail,

i mainly have problems understanding why ensureAuth in belows 
example refers to
"SampleService."  as an instance:

https://github.com/rejectedsoftware/vibe.d/blob/a1efc05c09135ca8aca21ccec72790ddfaca67c9/examples/web/source/app.d#L114

so how does PrivateAccessProxy work:
https://github.com/rejectedsoftware/vibe.d/blob/master/source/vibe/internal/meta/funcattr.d#L225