Login required by default, whitelisting public routes.