Security: authenticate / route as to not leak private dashboard urls

Secures the `/` route as well. Does not redirect or leak dashboard urls to un-authenticated clients.