require authentication for all resources except discovery and login

issue#244