We do need to force authentication on sessions/show. Oops.