The console is protected by default.
See the <management-interfaces> element, here the security-realm is set for each interface.
If you start the server without any change you will get a hint if you browse to the console that you have to add a password.
Use bin/add-user.* for this.
please upgrade to 7.1.x which has security features added.
you manage it the way Wolf mentionend.
Thanks to both of you.
I need to upgrade then.