Tvheadend 4.1.1945 - Blocking access without authentication

hi friends,

I use Tvheadend 4.1.1945 server on libreelec.

I noticed that I can access the list of channels without authentication. if I enter to the url channels and enter once the authentication details I get a M3U file that included the url for my channel. if I play this file in vlc and watch who are connected to my server I see that the ip of the vlc player is connected without username.

How can I block this option?

In addition, if some of my channels is iptv, the user that connect to my server get the direct url of the iptv channel or a url that my server give. (Is the original url of the channel invisible for the user?)

if i sign only the option for htsp protocol in the users settings, can someone to get watch my channels without authentication of username and password ?