Make /api/authenticate only available for logged in users