Only apply auth filter to core WP REST API requests

This should make the plugin compatible with other plugins that serve
"public" info on REST-like endpoints, like Activitypub.