Make sure that api requires authentication by default

Fixes #4096
fix backend layout assets tags

Fixes #4127