after adding the following options, /metrics still available to get accessed with no authentication

--basic-auth-user=<user>
--basic-auth-pass=<pass>

shouldn't /metrics be protected too as it can contain sensitive data?