requiresAuth property
Whether a request has to be authenticated before it sees anything.
Not a setting of its own. An admin reachable without a sign-in on a deployed application is the whole of the risk here, and making that optional is offering somebody a way to get it wrong on the one question where being wrong is expensive.
Implementation
final bool requiresAuth;