Protect all write routes with logged_in?