That is correct since in your config you have auth: false what means ignore all authentication and let me trough
auth: false