Pretty much you check ok that on every enpoint you need a user to be logged in also to identify who is getting in there