Once external_auth is enabled, it seems that all salt calls need to be authenticated. Without showing how to enable full access, admins are going to lock themselves out and get frustrated.