Instead of remembering to protect each new route, every route requires authentication and a permission unless it is explicitly listed as public. Forgetting then fails closed, not open.