Fix authentication handlers, don't authenticate non-API routes