Remove comments around protected routes

Currently, all supposedly protected routes are not. keycloak.protect functions are all commented.

Remove comments verify that auth protection is effective on all routes where it is needed.