Really fix shipment number generation

Fixes #4063

(really)
Make sure that api requires authentication by default

Fixes #4096