Could you add a comment like the famous old TODOBR so we don't forget to scope this route behind auth or to remove it.