Make sure that api requires authentication by default

Fixes #4096
Only count eligible promotions towards Promotion#credits

Fixes #4112