The route has been behind auth since aa848de, but the settings tab still
called it without a token: the 401 "Unauthorized" made the panel treat
the session as expired and log out on every visit to Settings. The mock
now requires auth on /ui/brand too, like the server.