I'd rather white-list some routes, in case I forget adding authentication middlewares to specific routes