fix(ui): require auth for coverage report and all UI subtree requests (#10971)