title: How to protect all routes, except one?
body: <p>I'm using Jared Hanson's <em>connect-ensure-login</em> approach, and the docs indicate that it integrates with passport by mounting the <code>authenticate()</code> middleware at the login route.</p>
  
  <p>I'm wondering if this means that only that route is protected? Or all routes are?</p>
  
  <p>Also, I currently have retry count/lockout logic in my app but this module seems rather simplistic in that it only redirects on failure.  Can it be made to use more complex logic?</p>