Enabling the option "Require authentication for request and uploads APIs.", is not avoid spam attacks via the chat widget. In fact, if you try to use the widget, no authentication is been required.

Am I missing something here