I believe Elasticsearch doesn't allow restricting access by requiring login unless you pay for the enterprise version, which is just straight up stupid.
But I still wonder why that isn't part of the open source version, and why it isn't turned on by default....