Add authentication. Protect only 'request test run' endpoint