We're likely to keep /updates/refresh long-term (to provide, say, a [🔄 Check for updates] button in the console), but this should be behind authZ because repeatedly refreshing can potentially (but hopefully shouldn't) interfere with updates working.

(From #717)