REST user lists

The protection removes relevant user endpoints from the REST API for visitors who are not logged in.

Author queries

It also blocks typical ?author=... requests that are often used to enumerate login names.

Purpose of the measure

The feature makes automated username harvesting harder. It does not replace strong passwords or two-factor authentication.