The URLS supported by the odl-mdsal-apidocs are not protected by the controller's AAA. This is a security vulnerability when the security model prohibits any access to the controller without authentication.