**Rejection Feedback:** The implementation should follow this approach: 1. **ApplicationController** - Add `require_login` before_action (all controllers protected by default) 2. **ApiController** - Override/disable authentication (skip before_action) 3. **No environment variable checks** needed 4. **Spec helpers** - Add auth helpers for tests (e.g., `login_as(agent)`) Please update the implementation accordingly.