Loophole in H2O authentication with Sparkling water

We noticed that when authentication is required
(with `-hash_login` for h2o backend/external cluster),
and users connecting to it from Sparkling Water,
then using SW endpoint they can login without username/password.

Seems to be a security loophole in authentication.

We would expect if authentication is enabled, all connections have to be authenticated,
not just ones that are going directly to h2o,