diff --git a/src/Tgstation.Server.Host/Controllers/AdministrationController.cs b/src/Tgstation.Server.Host/Controllers/AdministrationController.cs
index bb68d12467..c35de94da2 100644
--- a/src/Tgstation.Server.Host/Controllers/AdministrationController.cs
+++ b/src/Tgstation.Server.Host/Controllers/AdministrationController.cs
@@ -103,7 +103,7 @@ namespace Tgstation.Server.Host.Controllers
 				databaseContext,
 				authenticationContextFactory,
 				logger,
-				false)
+				true)
 		{
 			this.gitHubClientFactory = gitHubClientFactory ?? throw new ArgumentNullException(nameof(gitHubClientFactory));
 			this.serverUpdater = serverUpdater ?? throw new ArgumentNullException(nameof(serverUpdater));
diff --git a/src/Tgstation.Server.Host/Controllers/ApiController.cs b/src/Tgstation.Server.Host/Controllers/ApiController.cs
index 6c66ec832e..90a5c5f448 100644
--- a/src/Tgstation.Server.Host/Controllers/ApiController.cs
+++ b/src/Tgstation.Server.Host/Controllers/ApiController.cs
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Http;
+using Microsoft.AspNetCore.Http;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.AspNetCore.Mvc.Filters;
 using Microsoft.Extensions.Logging;
@@ -48,11 +48,6 @@ namespace Tgstation.Server.Host.Controllers
 		/// </summary>
 		protected Models.Instance Instance { get; }
 
-		/// <summary>
-		/// If <see cref="IAuthenticationContext.InstanceUser"/> permissions are required to access the <see cref="ApiController"/>
-		/// </summary>
-		readonly bool requireInstance;
-
 		/// <summary>
 		/// If <see cref="ApiHeaders"/> are required
 		/// </summary>
@@ -64,14 +59,12 @@ namespace Tgstation.Server.Host.Controllers
 		/// <param name="databaseContext">The value of <see cref="DatabaseContext"/></param>
 		/// <param name="authenticationContextFactory">The <see cref="IAuthenticationContextFactory"/> for the <see cref="ApiController"/></param>
 		/// <param name="logger">The value of <see cref="Logger"/></param>
-		/// <param name="requireInstance">The value of <see cref="requireInstance"/></param>
 		/// <param name="requireHeaders">The value of <see cref="requireHeaders"/></param>
 		public ApiController(
 			IDatabaseContext databaseContext,
 			IAuthenticationContextFactory authenticationContextFactory,
 			ILogger<ApiController> logger,
-			bool requireInstance,
-			bool requireHeaders = true)
+			bool requireHeaders)
 		{
 			DatabaseContext = databaseContext ?? throw new ArgumentNullException(nameof(databaseContext));
 			if (authenticationContextFactory == null)
@@ -79,7 +72,6 @@ namespace Tgstation.Server.Host.Controllers
 			Logger = logger ?? throw new ArgumentNullException(nameof(logger));
 			AuthenticationContext = authenticationContextFactory.CurrentAuthenticationContext;
 			Instance = AuthenticationContext?.InstanceUser?.Instance;
-			this.requireInstance = requireInstance;
 			this.requireHeaders = requireHeaders;
 		}
 
@@ -124,11 +116,11 @@ namespace Tgstation.Server.Host.Controllers
 		protected ObjectResult Created(object payload) => StatusCode((int)HttpStatusCode.Created, payload);
 
 		/// <summary>
-		/// Performs validation steps for an instance request.
+		/// Performs validation a request.
 		/// </summary>
 		/// <param name="cancellationToken">The <see cref="CancellationToken"/> for the operation.</param>
 		/// <returns>A <see cref="Task{TResult}"/> resulting in an appropriate <see cref="IActionResult"/> on validation failure, <see langword="null"/> otherwise.</returns>
-		protected virtual Task<IActionResult> ValidateInstanceRequest(CancellationToken cancellationToken)
+		protected virtual Task<IActionResult> ValidateRequest(CancellationToken cancellationToken)
 			=> Task.FromResult<IActionResult>(null);
 
 		/// <summary>
@@ -193,20 +185,11 @@ namespace Tgstation.Server.Host.Controllers
 					return;
 				}
 
-				if (requireInstance)
+				var errorCase = await ValidateRequest(context.HttpContext.RequestAborted).ConfigureAwait(false);
+				if (errorCase != null)
 				{
-					IActionResult errorCase = null;
-					if (!ApiHeaders.InstanceId.HasValue)
-						errorCase = BadRequest(new ErrorMessage(ErrorCode.InstanceHeaderRequired));
-					else if (AuthenticationContext.InstanceUser == null)
-						errorCase = Forbid();
-
-					errorCase ??= await ValidateInstanceRequest(context.HttpContext.RequestAborted).ConfigureAwait(false);
-					if (errorCase != null)
-					{
-						await errorCase.ExecuteResultAsync(context).ConfigureAwait(false);
-						return;
-					}
+					await errorCase.ExecuteResultAsync(context).ConfigureAwait(false);
+					return;
 				}
 			}
 			catch (HeadersException)
diff --git a/src/Tgstation.Server.Host/Controllers/HomeController.cs b/src/Tgstation.Server.Host/Controllers/HomeController.cs
index f8c5195413..58b20a3fe4 100644
--- a/src/Tgstation.Server.Host/Controllers/HomeController.cs
+++ b/src/Tgstation.Server.Host/Controllers/HomeController.cs
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Authorization;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -99,7 +99,6 @@ namespace Tgstation.Server.Host.Controllers
 				  databaseContext,
 				  authenticationContextFactory,
 				  logger,
-				  false,
 				  (browserResolver ?? throw new ArgumentNullException(nameof(browserResolver))).Browser.Type != BrowserType.Generic
 				  && (controlPanelConfigurationOptions?.Value ?? throw new ArgumentNullException(nameof(controlPanelConfigurationOptions))).Enable)
 		{
diff --git a/src/Tgstation.Server.Host/Controllers/InstanceController.cs b/src/Tgstation.Server.Host/Controllers/InstanceController.cs
index aacf3a0fe6..126458dba5 100644
--- a/src/Tgstation.Server.Host/Controllers/InstanceController.cs
+++ b/src/Tgstation.Server.Host/Controllers/InstanceController.cs
@@ -90,7 +90,7 @@ namespace Tgstation.Server.Host.Controllers
 				  databaseContext,
 				  authenticationContextFactory,
 				  logger,
-				  false)
+				  true)
 		{
 			this.jobManager = jobManager ?? throw new ArgumentNullException(nameof(jobManager));
 			this.instanceManager = instanceManager ?? throw new ArgumentNullException(nameof(instanceManager));
diff --git a/src/Tgstation.Server.Host/Controllers/InstanceRequiredController.cs b/src/Tgstation.Server.Host/Controllers/InstanceRequiredController.cs
index a2474c0c34..2ec482ef59 100644
--- a/src/Tgstation.Server.Host/Controllers/InstanceRequiredController.cs
+++ b/src/Tgstation.Server.Host/Controllers/InstanceRequiredController.cs
@@ -37,15 +37,19 @@ namespace Tgstation.Server.Host.Controllers
 				  databaseContext,
 				  authenticationContextFactory,
 				  logger,
-				  true,
 				  true)
 		{
 			this.instanceManager = instanceManager ?? throw new ArgumentNullException(nameof(instanceManager));
 		}
 
 		/// <inheritdoc />
-		protected override async Task<IActionResult> ValidateInstanceRequest(CancellationToken cancellationToken)
+		protected override async Task<IActionResult> ValidateRequest(CancellationToken cancellationToken)
 		{
+			if (!ApiHeaders.InstanceId.HasValue)
+				return BadRequest(new ErrorMessage(ErrorCode.InstanceHeaderRequired));
+			if (AuthenticationContext.InstanceUser == null)
+				return Forbid();
+
 			if (ValidateInstanceOnlineStatus(instanceManager, Logger, Instance))
 				await DatabaseContext.Save(cancellationToken).ConfigureAwait(false);
 
diff --git a/src/Tgstation.Server.Host/Controllers/UserController.cs b/src/Tgstation.Server.Host/Controllers/UserController.cs
index 5144039371..485216faa4 100644
--- a/src/Tgstation.Server.Host/Controllers/UserController.cs
+++ b/src/Tgstation.Server.Host/Controllers/UserController.cs
@@ -1,4 +1,4 @@
-using Microsoft.AspNetCore.Mvc;
+using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
 using Microsoft.Extensions.Options;
@@ -58,7 +58,7 @@ namespace Tgstation.Server.Host.Controllers
 				  databaseContext,
 				  authenticationContextFactory,
 				  logger,
-				  false)
+				  true)
 		{
 			this.systemIdentityFactory = systemIdentityFactory ?? throw new ArgumentNullException(nameof(systemIdentityFactory));
 			this.cryptographySuite = cryptographySuite ?? throw new ArgumentNullException(nameof(cryptographySuite));