/api/contents reachable while user not logged in

Context: notebook version 6.0.0., protected by a password, launched has jupyter lab.

while session is log out, I still can access /api/contents.
However, /api/kernels returns an error message {"message": "Forbidden", "reason": null}, which is the expected result.

Reproduce the behavior in Jupyter Notebook 6.0.0 with password protection enabled: log out and request /api/contents, then compare it with /api/kernels. The work is done when unauthenticated access to /api/contents is rejected consistently with the protected endpoint.

Written by the indexing model from the issue text.