[DO NOT MERGE] 631 public project login restriction

@pld please checkout this out.

Given that the API has security checks for protected resources, is there a specific reason to have all routes wrapped with the `(wrap-authentication)` call?