Use the HalRestricted skin selection to prevent anonymous user to access the API.

This allow the JS application to be informed that the user is not authenticated (and so, it can prevent allDocs call without results).

Consider this code as a proof of concept which should be instead be done at PAS level.

Restricted access on WebSection level can not be done currently, as it will redirect the query to the ERP5 login_form page template.