The "localauth" setting:

If enabled, require that HTTP connections from
127.0.0.1 be authenticated by password.  If
false, all HTTP requests from localhost have
unrestricted access to the repository.