[security] Middleware is passthrough — all routes publicly accessible