[Security] anonymous access to configs possible through Direct object reference

After adding the password field to bootstrap.yml we are still able to access the configuration directly via the config path.
for e.g. /config/APPNAME/PROFILE/LABEL allows access to the configuration even though on the portal we are not logged in.