Spec'd and implemented the /post/add routed to refuse to accept any posts from someone who isn't logged-in.