index-loggedin.html isn't behind a protected route

[martingaston]

can be viewed by just navigating direct to /index-loggedin.html - looks like it gets picked up by the catch-all public endpoint