Security for non-logged-in users when reverse proxied

[mgrimace]

Hi,

I have Ocular reverse proxied to budget.mydomain.com - it looks like by default, even non-logged-in users can interact with the app (e.g., load demo data, import config.json, etc.), even if they can't save their own data. If it's exposed to the internet, is there a way to have zero interaction possible until a user logs in?

Alternatively, is there support for Authentik or Authelia?