Require authentication for all paths except /