Make all resources require authentication except POST /users (registration).