Atom and JSON CMIS servlets should be configured as Automation or Rest API with a specific authentication chain triggering the AUTOMATION_BASIC_AUTH and TOKEN_AUTH plugins.
It should make them work like the Automation or REST API, and avoid redirecting to the login page if no authentication is provided.