order of login_required annotation

[LeiYangGH]

Describe the bug
if login_required is not closest to the function then seems it is not protected.

To Reproduce
Steps to reproduce the behavior:

1. i use blueprints, and my function is like

@blueprint_name.route("/protected")
@flask_login.login_required
def protected():

3. if i switch @flask_login.login_required and @blueprint_name.route("/protected"), then the view can be accessed without login.

Expected behavior
The annotion order doesn't matter.

[davidism]

Decorator order matters in Python. @login @route view means "register the view, then create a new function that wraps the view with login", while @route @login view means "wrap the view with login, then register that wrapped view". This is a property of Python, and you'll want to understand this for decorators in general, not just flask-login.

[LeiYangGH]

thanks!