The previous API had authentication. The new API was rolled out earlier this year, and it seems like a pretty bizarre omission indeed.

edit: I will inform HN if my climate control mysteriously turns on today :)