[basex-talk] Database credentials not enforced over REST?

Hi, If I contact a BaseX instance over REST, I can drop databases/collections without passing credentials in basic auth header, using command= query param (is there any other mechanism for auth over REST supported by BaseX?). Tried this on a collection newly created using REST...do we have to 'add' credentials to DB/collection after creating it? If yes, how? Regards, Mahender