REST API Ignores Auth Failure

If a web browser is used to access the REST API and NO credentials are used (vs invalid), data is returned instead of unauthorized. (Unable to reproduce using a command line REST client.)