Should enforce requireLogin on the backend.