Require authentication on every controller except Welcome