All /api/v1 endpoints now require authentication with email and token headers