Require auth by default, add --no-auth flag

In order to prevent users from accidentally exposing rest-server without
authentication, rest-server now defaults to requiring a .htpasswd. If
you want to disable authentication, you need to explicitly pass the new
--no-auth flag.

mux.go

@@ -21,6 +21,7 @@ var Config = struct {
 	TLSKey       string
 	TLSCert      string
 	TLS          bool
+	NoAuth       bool
 	AppendOnly   bool
 	PrivateRepos bool
 	Prometheus   bool