GSI Index settings can be changed without authorization

currently, to writing settings for debugging, read settings into a file, modify and

curl localhost:9102/settings -d @settings:json

This does not require any authorization. Which makes it vulnerable.