I would suggest we do provide an out-the-box config that secures the HTTP endpoint:
<management>
<security-realms>
<security-realm name="ManagementRealm">
<authentication>
<users>
<user username="admin">
<password>password</password>
</user>
</users>
</authentication>
</security-realm>
</security-realms>
</management>
Any objections or good reasons not to do it?
Ike