We should specify the routes required authentication, avoiding unused auth requests to Supabase (will induce usage) when a public route is accessed.