by default we should now auth reads

We were originally defaulting this to false due to a client issue. Now that the client always passes the authToken, we should default to authing both reads and writes.