I tried this few weeks ago and there was no authentication on rebuild trigger, so anyone who knows your site url can start build and deploy. I don't know if things have improved since then.