Auth protect /public too