I am not a big fan of this... I think it is letting the domain of the UI bleed into the gateway, which should be agnostic since it will not only be used by the UI. I would rather see the return contain something else and have the UI flask layer interpret it to require a login