Make /api/.. and /async/.. return a 403 if the auth is requird