Pre auth

basically all the routes now respect security.
Yep, I pushed up a fix for this.