Read-only events should require authentication

[pes10k]

This issue is being filed as part of the requested PING review, and on behalf of @NalaGinrut who did the review (who i hope will correct me if I've misstated their concerns).

There is a concern that even read-only requests in the API should require authentication, since read-only requests like "is the lamp turned on," can reveal and / or contribute to identifying an individual. This concern is with both the "HTTP Basic Profile", but also other read-only descriptive actions (e.g., queryallactions, etc)

Are there reasons to not require authentication for these kinds of actions? Is authentication already required but we missed it?

[pes10k]

cc @NalaGinrut (though please let me know if i can help with discussion or handling this issue)