If the session is backed by an API (the usual case, I'm assuming), then it'd need more than a controller, wouldn't it? Isn't the route the standard way to obtain data? Chances are I just have a limited view of what should/could happen. Irrespective, that's why it'd be good to have a non-trivial API backed session authentication example rather than this hard-coded "isAuthenticated: false" one. Unless I've missed something?