Fixed some execution paths ignoring auth
Added auth for routes that don't require session keys
Fixed minor bug in auth procedure