Authentication for non-loopback clients

This has been a security concern for as long as BMBF has existed, we should probably actually do something sensible about it with BMBF 2.

It should be enabled by default.