Admin route reachable without auth

Why it matters

An admin page or API answered without asking who we were.

How to fix it

Check the session server-side in the route handler (not just in the page's JavaScript) and return 401/404 when it's missing.

How we test it

Passive — runs in the free check, looks only at what a browser can see.