There's a middleware called ensureAuthenticated (see how for instance /api/userconfig) that makes sure the user is authenticated (if he uses that option, can be turned on from the settings file) before handling the request, and which should be used here.