This is limited to only API requests as this middleware will only operate on routes prefixed with `/api`, see [this line here](https://github.com/ably-forks/jsbin/blob/a97f5daa1103e05ff5cf9f8459ec8a8578bcfa5a/lib/middleware.js#L197).  Also, you must bear in mind that only [3 routes](https://github.com/ably-forks/jsbin/blob/a97f5daa1103e05ff5cf9f8459ec8a8578bcfa5a/lib/routes.js#L59) currently exist for the API so as far as I can see, I am not sure how authenticating via the API has any negative affect because the authentication it's stateless, and we have complete control over what the user can do.