Pre auth

basically all the routes now respect security.