Clearer authentication rules
Clearer authentication rules

Make it obvious that all POSTs except for user registration require
authentication, and that almost all GETs are fair game.

jml/hazard,jml/hazard