Metrics authentication should be optional

For simplicity in certain environments, access to the metrics endpoint should be allowed without requiring authentication.
We can add a new `metrics-auth` attribute on the `endpoint` element that toggles this.