sling 3 installation observations

[Andreas Amstutz]

Hi all

I just deployed org.apache.sling.launchpad.webapp-3-incubator on my  
public tomcat dev server and observed that the access to /system/ 
console/ is not secured by default.

Shouldn't access to the console be secured by default?

Webdav access to http://host/slingwebapp3/ is also possible without  
providing any credentials.

How do I secure webdav access?

Regards
Andreas