POST requests should always require auth