Explicitly set action roles for each of the controllers' actions at the top of the file because:

1) using the "__PACKAGE__->config( action_roles => [ ... ], )" led to Catalyst applying API key authentication action roles to "sub end()" - which takes care of error reporting - so errors weren't being reported correctly (in JSON)
2) it's (hopefully) better to see which actions are "public" / "non-public" in a single place