web-security 2020-08-11

thanks, that's a helpful way of thinking about it. agree i should just add auth to the endpoint