All the expensive endpoints should be behind user registration. Only static pages, or other cheap endpoints should be public.