I'm happy to change this to a report_vuln, since that seems to fit.   I will also need to extend this patch to cover couchdb which currently reports not using authentication as creds.