List authenticated and unauthenticated endpoints in the doc
From what I get, the following endpoints should/could be accessed unauthenticated :
"^/r/"
-
"^/js/"
, -
"^/img/"
, -
"^/css/"
, -
"^/lang/"
, -
"^/font/"
, -
"^/partial/"
, -
"^/download/"
, -
"^/upload"
, -
"^/guest/"
, -
"^/about"
, -
"^/delays$"
, "^/fulstats$"
If correct, it might be useful to list them in the README file to sysadmin could refer to it when setting up a WAF or reverse-auth proxy