Control and Metrics APIs asking for authentication despite not configuring for it

[OIZid]

Question

I took the default config file, changed only api and metrics to yes, and whenever I try to access them through http://localhost:9997/v3/paths/list or localhost:9998/metrics, it prompts for username and password on a browser, or returns 401 with curl.
What am I doing wrong here?