Restrict Unauthenticated shouldn't be in Authentication tab
Authentication tab is for instance auth (account login / authorization) settings.
The Restrict Authenticated section should probably be in Instance near the "Public" and "Limit to local content" settings.
These are partially redundant and confusing. I'm looking into refactoring this, but the settings should still be moved.
Edited by feld