Mistakenly removed in 4577ac0717. Composer itself does the authentication, not the gateway, therefore we do need the auth exclude. Added a comment to explain why it's attached to the api socket and not a separate listener.
4577ac0717