With re-enabling REST endpoint security its configuration changes little bit and documentation needs to be updated. Authentication is now in separate sub-element:

<rest-connector socket-binding="rest" cache-container="security">
    <authentication security-realm="ApplicationRealm" auth-method="BASIC"/>
</rest-connector>