The route-permission fence (#52) failed in CI, not locally: I had run the
fonts and import-export suites, not the full api suite, and the fence needs
a database. `@AuthenticatedOnly()` is the rule the route always meant — a
session, no further permission.
