Why does the API warn about a missing Bearer and provides information nevertheless?

HA gives the following warning:

2018-12-27 20:28:26 WARNING (MainThread) [homeassistant.components.http.auth] You need to use a bearer token to access /api/states/sun.sun from 10.100.10.30
2018-12-27 20:28:26 INFO (MainThread) [homeassistant.components.http.view] Serving /api/states/sun.sun to 10.100.10.30 (auth: True)

Right afterwards (second line) it does provide the information to 10.100.10.30.

Indeed, on 10.100.10.30:

root@rpi1 ~# curl -L https://hass/api/states/sun.sun
{"attributes": {"azimuth": 272.29, "elevation": -33.62, "friendly_name": "Sun", "next_dawn": "2018-12-28T07:07:16+00:00", (...)

What is this warning for?

Is this because a call to an API normally requires a Bearer but being on a Trusted Network allows me to bypass that? (in which case the warning is not really useful)