* server : make models endpoints private when authentication is enabled * tests : fix models endpoint auth