Public access can be configured in security.yml, closes #2