You both are absolute right, that is a fugly peace of code. I was thinking about  it as well and we currently have the problem, that Ghost has to do the authentication before CSRF validation to be able to return the proper status codes. Since not all routes in admin need authentication but CSRF validation I ended up with this solution :-(. It is definitely something we should get rid of in the near future. Maybe as part of #2182?

I'm going to update the PR with @hswolff suggestion :+1:.