Protect auth calls. Closes #1513