Add some missing login-required checks
JSON endpoints shouldn't throw raw http400
API endpoint for adding a Rad by Lib name