http://localhost:4000/#/account when not logged in

I know it's only a sample app (so this isn't the point) but I can visit http://localhost:4000/#/account when not logged in, and start a 401 redirect loop by trying to change the password of a user.
