Actually, don't restrict login.get to logged in users

There's no harm in exposing anonymity
Restrict some routes from "everybody"