Disallow any unauthenticated API requests that are not GET