disable auth works now with api

api/v1/api.go

@@ -73,10 +73,8 @@ func (api *API) ListEndpoints() http.Handler {
 }
 
 func InstallHTTPHandler(r *mux.Router, st *store.Store, im *importer.Importer, infoLog, errLog, dbgLog *log.Logger) {
-	api := NewAPI(st, im, infoLog, errLog, dbgLog)
-
-	// TODO: what if authentication is disabled?
 	r.Use(auth.Middleware)
+	api := NewAPI(st, im, infoLog, errLog, dbgLog)
 
 	// Shows
 	showsHandler := make(handlers.MethodHandler)