No indication of auth being required

This is probably something that could be done through core. Effectively per route and then method on that route.

In Restsplain terms we could do background requests to each route, probably just with `GET` methods (with the exception of generating proper required params, no `url` type for example). Then we could check the responses for error codes and if it's a 401 add some data about that route and show a padlock icon.

It's a lot of requests but ok in the background perhaps.