My first full-stack app had no auth. Adding it later nearly broke everything.