There should be protected routes and unprotected routes that depend on the user having a cookie or not (or what level of access they have).

[rosalie-baxter]