We have random routes mixed in that require server-internal auth, should probably move them under /_spacebar/cdn instead?
Would be nice if we had both upload and delete routes here, so we can use the CDN as a "file storage abstraction layer" when ie. deleting messages/users/...