censor build events in api if not auth'd

also backfill a ton of api tests for authentication