Make sure that api requires authentication by default

Fixes #4096
[api] Split taxon_ids as they're passed to Products#create and Products#update