Hmm, actually Eric, authentication only happens when called directly in brainCloud.
If you try calling an API and your app isn't authenticated, you'll receive an error - and generally would trigger authentication yourself as part of your error handling.
Does that make sense?
Paul.