/rest/api/1.0/users/{userSlug} requires no authentication

According to the REST API documenation this endpoint should require authentication.

Anyone can obtain user's full name, email, userid, as well as personal repositories without any authentication.