Currently in production accessing the object storage api's root endpoint can. Should just be a change to the middleware here https://github.com/ral-facilities/object-storage-api/blob/develop/object_storage_api/auth/jwt_middleware.py#L42.