diff --git a/Configuration/Routes.yaml b/Configuration/Routes.yaml
index ed73f34..517a4e8 100644
--- a/Configuration/Routes.yaml
+++ b/Configuration/Routes.yaml
@@ -1,35 +1,35 @@
 # backend editor ajax routes
 -
   name: 'H5P Backend Editor AJAX'
-  uriPattern: 'h5p/editor'
+  uriPattern: 'neosh5p/editor'
   defaults:
     '@package': 'Sandstorm.NeosH5P'
     '@controller': 'Backend\EditorAjax'
     '@action': 'index'
 -
   name: 'H5P Backend Editor AJAX - content type cache'
-  uriPattern: 'h5p/editor/content-type-cache'
+  uriPattern: 'neosh5p/editor/content-type-cache'
   defaults:
     '@package': 'Sandstorm.NeosH5P'
     '@controller': 'Backend\EditorAjax'
     '@action': 'contentTypeCache'
 -
   name: 'H5P Backend Editor AJAX - library install'
-  uriPattern: 'h5p/editor/library-install'
+  uriPattern: 'neosh5p/editor/library-install'
   defaults:
     '@package': 'Sandstorm.NeosH5P'
     '@controller': 'Backend\EditorAjax'
     '@action': 'installLibrary'
 -
   name: 'H5P Backend Editor AJAX - library upload'
-  uriPattern: 'h5p/editor/library-upload'
+  uriPattern: 'neosh5p/editor/library-upload'
   defaults:
     '@package': 'Sandstorm.NeosH5P'
     '@controller': 'Backend\EditorAjax'
     '@action': 'uploadLibrary'
 -
   name: 'H5P Backend Editor AJAX - single library details'
-  uriPattern: 'h5p/editor/libraries'
+  uriPattern: 'neosh5p/editor/libraries'
   defaults:
     '@package': 'Sandstorm.NeosH5P'
     '@controller': 'Backend\EditorAjax'
@@ -37,7 +37,7 @@
   httpMethods: ['GET']
 -
   name: 'H5P Backend Editor AJAX - multiple libraries'
-  uriPattern: 'h5p/editor/libraries'
+  uriPattern: 'neosh5p/editor/libraries'
   defaults:
     '@package': 'Sandstorm.NeosH5P'
     '@controller': 'Backend\EditorAjax'
@@ -45,7 +45,7 @@
   httpMethods: ['POST']
 -
   name: 'H5P Backend Editor AJAX - editor file upload'
-  uriPattern: 'h5p/editor/files'
+  uriPattern: 'neosh5p/editor/files'
   defaults:
     '@package': 'Sandstorm.NeosH5P'
     '@controller': 'Backend\EditorAjax'
@@ -55,7 +55,7 @@
 # backend content upgrade ajax routes
 -
   name: 'H5P Backend content upgrade AJAX - execute content upgrade'
-  uriPattern: 'h5p/contentupgrade/migrate/{oldLibraryId}'
+  uriPattern: 'neosh5p/contentupgrade/migrate/{oldLibraryId}'
   defaults:
     '@package': 'Sandstorm.NeosH5P'
     '@controller': 'Backend\ContentUpgradeAjax'
@@ -63,7 +63,7 @@
   httpMethods: ['POST']
 -
   name: 'H5P Backend content upgrade AJAX - get library info'
-  uriPattern: 'h5p/contentupgrade/libraryinfo(/{libraryName}/{majorVersion}/{minorVersion})'
+  uriPattern: 'neosh5p/contentupgrade/libraryinfo(/{libraryName}/{majorVersion}/{minorVersion})'
   defaults:
     '@package': 'Sandstorm.NeosH5P'
     '@controller': 'Backend\ContentUpgradeAjax'
@@ -101,7 +101,7 @@
 # neos fullscreen inspector routes
 -
   name: 'H5P Neos inspector - fullscreen editor content controller routes'
-  uriPattern: 'h5p/contentfullscreeneditor/{@action}(/{content})'
+  uriPattern: 'neosh5p/contentfullscreeneditor/{@action}(/{content})'
   defaults:
     '@package': 'Sandstorm.NeosH5P'
     '@controller': 'Backend\Content'
diff --git a/Configuration/Settings.yaml b/Configuration/Settings.yaml
index 9dd1379..72f7351 100644
--- a/Configuration/Settings.yaml
+++ b/Configuration/Settings.yaml
@@ -111,6 +111,20 @@ Neos:
         Sandstorm.NeosH5P: true
 
   Flow:
+    # We add a request pattern for our controllers to the Neos Backend provider,
+    # so that XHR requests that go directly to these controllers (and not through
+    # a ModuleController subrequest) can be authenticated as well
+    security:
+      authentication:
+        providers:
+          'Neos.Neos:Backend':
+            requestPatterns:
+              'Sandstorm.NeosH5P:BackendControllers':
+                pattern: 'ControllerObjectName'
+                patternOptions:
+                  controllerObjectNamePattern: 'Sandstorm\NeosH5P\Controller\Backend\.*'
+
+
     # We need the tag "@variable" as an ignored annotation, because otherwise parsing of the
     # H5PFrameworkInterface causes a reflection error
     reflection: