Add test for protected routes
Wrap protected-routes in a guard to prevent non-/admin pages from requiring authentication

Listing the not-found route below the protected route will make it require authentication,
and listing the protected-routes below the not-found route will make them 404. Adding a
simple guard function will fix this as long as we only need to ever protect /admin or a few
other directories (otherwise the if statement would become annoyingly large).

See: https://github.com/remvee/ring-basic-authentication/wiki/Home/e9b6ef051d8e2863c20259f8ee8d39ffc8c30c3e