No Authentication endpoint can be called by anyone

[Key-to-Code]

Anyone who knows this endpoint can call it.
No JWT, no session, no API key, no role check.

A random user can approve or reject any loan

[Rishiikesh-20]

solved issue before the break phase