Check for authentication inside endpoint instead. Allow post hash in single_post.