Thanks for the tip, I went through my site and disabled all the plugins until Watson worked, and then reenabled the plugins one by one to determine the culprit. And the winner is, the Password Protected plugin (https://github.com/benhuson/password-protected)!
Duh, kinda obvious when you think about it. I did not have Allow REST API Access enabled. Haha, no wonder the REST API end point required authentication, because I told it to! (and totally forgot)
