When basic auth is configured:

authentication: true,
      onAuthenticate: function (req, username, password) {
        return false
      },

/swagger-stats/metrics and /swagger-stats/ui will ask for authentication. However /swagger-stats/ux will not.