Return parent after redirect to Kohana. What for?

Question

Kohana

Good day. I don’t quite understand who we are, what we are returning and why?
Here is a class that does not allow non-logged in users to pages:

<?php defined('SYSPATH') or die('No direct script access.');

class SecurityController extends Controller_Template {

public function before(){
$session = Session::instance();
$session->set('auth_redirect', $_SERVER['REQUEST_URI']);

$auth = Auth::instance();
if (!$auth->logged_in())
{
Controller::redirect('auth');
}
return parent::before();
  }
    }

I understand that if not logged in, we will be redirected to the authorization page, but I don’t understand why we need to return something else ...
Just in case, the authorization class:

<?php defined('SYSPATH') or die('No direct script access.');

class Controller_Auth extends Controller_Template {

public $template = 'base';

  public function action_index()
  {
$auth = Auth::instance();
$data = array();
if ($auth->logged_in())
{
Controller::redirect('');
}
else
{
if (isset($_POST['btnsubmit']))
{ 
      $login = Arr::get($_POST, 'login', '');
      $password = Arr::get($_POST, 'password', '');
        if ($auth->login($login, $password))
        {
        $session = session::instance();
        $auth_redirect = $session->get('auth_redirect','');
        $session->delete('auth_redirect');
        Controller::redirect($auth_redirect);
        }
        else
        {
        $data['error'] = true;
        }
    }	
}

    $this->template->content = view::factory('authview',$data);
  }

  public function action_hpass() {
  $auth = Auth::instance();
  $this->template->content = $auth->hash_password('admin');
  }
  
public function action_logout() {
$auth = Auth::instance();
$auth->logout();
Controller::redirect('auth');
}
}

Answer 1

Return can be used to terminate script execution. You can teach the browser not to listen to redirects. There were cases when after the redirect there was an authorization code. Such holes are still found today.

Answer 2

I understood what the trick is ... Since my "Main" controller, which I did not even specify, inherits "SecurityController", and the "before ()" method is executed first, then in the case when the user is already logged in, nothing further can happen if we don't return anything. I understand correctly?
"Main" class

<?php defined('SYSPATH') or die('No direct script access.');

class Controller_Main extends SecurityController {

public $template = 'base';

public function action_index()
{
$this->template->content = view::factory('home');
}

}

Answer 3

return parent::before() is called after the if condition. If the condition works, there will be a redirect and the return will be ignored. If it doesn't work, return will be called. What is the difficulty with understanding?