Correct behaviour from unauthenticated curl request?

[gary-rowe]

From Ken Yee via email:

Have you ever tried doing "curl" on a secured REST API like this with your github openid dropwizard project?

    @GET
    @Timed
    @CacheControl(noCache = true)
    public List<Event> getEvents(
            @RestrictedTo(Authority.ROLE_PUBLIC) User publicUser) {
    }

curl http://localhost:8080/user/events actually returns the basemodel like this:

  {"model":{"user":null,"markdownHtml":"<h1>Markdown: Syntax</h1><p>This text is lifted from <....}}

when you don't send the authentication credentials http header.

If you're authenticated, it returns the proper json data (the event objects).