True, you absolutely should have security and authorization setup. But if the server replies to the request with a 401 or 403, rather than a 404, you at least know that there is something there.