Lock down tinyPaul for folks without auth

[cubap]

[cubap]

https://auth0.com/docs/quickstart/backend/java-spring-security5/interactive

Would be a more toggleable way to do this,

[cubap]

we probably need to verify the token, but do not need to recheck with Auth0. In fact, Auth0 discourages this behavior, instead relying on expiring tokens to limit vulnerability.