We don't even have to make analogies; if it is protected information a "reasonable person" expects some kind of _obligatory_ login authentication, not an optional one.