What's the designed purpose of modsecurity for Apache/Nginx?
Does it play the role of authentication (Basic/Forms/Cookie)?
From my research, it appears to be a Web Application Firewall feature. The features like Authentication are best left to the native web-server authentication functionality like mod_auth_basic or the application framework security components.
Researched Sources