I've had a look at that repo (on github) and the behaviour you get is what I'd expect. If you look at Application.cfc in that repo it refers to

onRequest

which then delegates to

MyApplication.cfc

https://github.com/ddspringle/framework-one-secure-auth/blob/master/Application.cfc#L295