Only /api is secured, Log Out removed from security