No indication of auth being required

[roborourke]

This is probably something that could be done through core. Effectively per route and then method on that route.

In Restsplain terms we could do background requests to each route, probably just with GET methods (with the exception of generating proper required params, no url type for example). Then we could check the responses for error codes and if it's a 401 add some data about that route and show a padlock icon.

It's a lot of requests but ok in the background perhaps.