IB security on Inbound Asynchronous question

Hello all.

We're using Peopletools 8.61.07.

I'm testing in SoapUI to POST an Async IB message to my DEV environment. I tried adding a Password to a New Node.    This works fine in SoapUI with Basic Auth. However if I take off the Basic Auth in SoapUI - whoops! It STILL works - as if I didn't have a password on the Node at all!

I find the documentation for ASYNC in-bound security very elusive and confusing.

I just want to add Basic Authorization to an in-coming payload so I can have some security for an External Vendor.

Please help!

Thank you!!