Add minimal auth checks ensuring 401 Authentication required is returned when unauthenticated for POST/DELETE/GET on shares and POST on admin/set-admin-role. Matches existing test style.
