Suggested by @dhartunian

the problem to solve is that it's currently just too easy to create a test for a HTTP API without authentication, which does not invite the implementer to care about authn (nor authorization).

We can nudge this in the right direction by renaming the "simple" method to a longer name with a discouragement in the comment; then renaming the admin method to a "simple" name so that it's easier to find.

Jira issue: CRDB-13044