Changed our authentication scheme to a per class basis. This will let us hit things like /registration even if we're not authenticated.

AllowAny is important. Don’t forget.