Fix lost } in nav-loggedin
Use session auth for read-only stuff