Allow anonymous access to _index

Cores-ng makes call to _index when initialised, so need to allow anonymous access for when API is secured.