api: annotate request with auth/throttle
test/api: ensure by default, annotated auth is of apis default Auth type