Oops indeed. (Downloading can be fine in many---but not all---cases, but the lack of authentication is not really justifiable!) The latest comment does hint that it will change in the near future, as the change is required for remote development anyway:
> Status update: We are still working on this! The major blocker is that extensions have not been setup to interact with setting. However, we also need to change this API to support our upcoming remote development feature. So we're going to roll both of these breaking changes into a larger extension update, coming this November or December :)
> Status update: We are still working on this! The major blocker is that extensions have not been setup to interact with setting. However, we also need to change this API to support our upcoming remote development feature. So we're going to roll both of these breaking changes into a larger extension update, coming this November or December :)