ALLOW_UNAUTHENTICATED_SEARCH_API
users can set ADDON_PASSWORD if unauthenticated access is not desired