/status is always POST authenticated