Disable REST API Anonymous Access?

With WordPress 4.7, the REST API allows anonymous access to a site’s user’s userid, username, gravatar hash and website URL All anyone has to do is visit a WordPress 4.7 site via the URL example.com/wp-json/wp/v2/users and they get a nice list of userids for all the admins.

Before WordPress 4.7, it was possible to disable the REST API with a filter, but that no longer seems to work.

Maybe the folks at WordPress are going to plug this hole, but if not, it would be great if you could add protection against anonymous access to the REST API to the Shield plugin.