Only calls to the REST API are now protected on the server.