This has changed. You have to set a site password should you want to prevent public access.
Related posts: