api/auth/nil: initial commit, to simplify logic for unauthenticated routes