Exercise 2: What Actually Changed Since Chapter 8 — Possible Solution
====================================================================

WHAT LOOKS IDENTICAL BETWEEN STEP 5 AND CHAPTER 8
------------------------------
Per this chapter, the route, the Zod schema, the safeParse
validation, and the raw SQL UPDATE call are all exactly the same code
written in Chapter 8 - nothing about the request-handling mechanics
changed.

WHAT ACTUALLY CHANGED
------------------------------
Per this chapter, Chapter 8 deliberately left the endpoint with no
authentication check at all, since Express had no conventional place
for one to even go yet. Chapter 9 added exactly that missing piece as
a real middleware function. By the time this capstone reaches Step 5,
that added middleware is what determines whether the identical-
looking submission actually succeeds.

THE EXACT LINE RESPONSIBLE
------------------------------
Per this chapter, the responsible addition is the requireAuth
argument inserted into the route registration itself:

  app.post('/api/pages/:id/title', requireAuth, async (req, res) => {

- requireAuth did not exist in Chapter 8's own version of this route
at all; it was added as a new middleware argument in Chapter 9.

WHY THIS WORKS AS AN ANSWER
------------------------------
It correctly identifies that the surrounding code is unchanged since
Chapter 8, and correctly identifies the requireAuth middleware
argument - absent in Chapter 8, present since Chapter 9 - as the
exact difference responsible for the request now being genuinely
protected.