You're right; the /api/v1/mutes entrypoint (and others) needs authentication and should return 401 if none is provided, but in #snac's case it's just a stub that returns an empty array, so it's irrelevant what HTTP code it returns.

I may change it to return the correct code eventually, but I don't consider it a priority.