Protect authentication-required routes

Close #11.