Make sure that api requires authentication by default

Fixes #4096