actually apply API auth checks

This corrects an error when removing the guest login functionality that
would allow API access with no authentication