fix seeding with proper key prefix
introduce requireAuth and endpointAuth

- requireAuth will override endpoint settings and always require
  authentication on all endpoints
- endpointAuth will delegate this to the endpoint.auth truthiness