Well, i think i got it figured out.
The only action allowed without being logged in is the login_form. So instead of using home i need to use this hook and put the new functions in front (PRE) of that action.
The function itself can check for any authorisation conditions. I.e. fail if not logged in or not having certain permisions.