Authenticate all backend routes

Fixes #225