Add a password protected 'open' endpoint