Put Metrics endpoint behind token

[dewey]

Not even sure if it's necessary, have to think about it.