This route expects a trusted Cloudflare Access identity in production. Local development bypasses the check.