diff --git a/modules/rsocials/components/folk-campaign-wizard.ts b/modules/rsocials/components/folk-campaign-wizard.ts
index a569bec..658ea81 100644
--- a/modules/rsocials/components/folk-campaign-wizard.ts
+++ b/modules/rsocials/components/folk-campaign-wizard.ts
@@ -170,6 +170,12 @@ export class FolkCampaignWizard extends HTMLElement {
 	}
 
 	private async createWizard(): Promise<string | null> {
+		const token = (window as any).__authToken || localStorage.getItem('auth_token') || '';
+		if (!token) {
+			this._error = 'Please sign in to create a campaign wizard';
+			this.render();
+			return null;
+		}
 		try {
 			const res = await this.apiFetch('/api/campaign/wizard', {
 				method: 'POST',
diff --git a/server/index.ts b/server/index.ts
index 8a2922b..4987d8a 100644
--- a/server/index.ts
+++ b/server/index.ts
@@ -2322,7 +2322,8 @@ for (const mod of getAllModules()) {
 			|| pathname.includes("/rcart/api/payments")
 			|| pathname.includes("/rcart/pay/")
 			|| pathname.includes("/rwallet/api/")
-			|| pathname.includes("/rdesign/api/");
+			|| pathname.includes("/rdesign/api/")
+			|| (c.req.method === "GET" && pathname.includes("/rvote/api/"));
 
 		if (!isHtmlRequest && !isPublicEndpoint && (vis === "private" || vis === "permissioned")) {
 			const token = extractToken(c.req.raw.headers);