Glossary: Web App Security and Authentication

Deny by default

Refusing every request until a route proves who you are and that you're allowed. kc-shop's /me started by refusing everyone.