Disallow API access for unauthenticated users.
Move workspace setup into a dedicated script for use outside Travis.