All of these need to have a @login_required decorator to make sure that someone can't hit these URLs when they're not supposed to.