By default, web connections from have full setup privilege without
needing to log in.  To disable this, go to Setup:Access and check the box
at the top that says "Require password for local access".