17.4 go get now require authentication in private repo (?go-get=1)

From docs, it says

To use a private project in a subgroup as a Go package, you must authenticate Go requests. Go requests that are not authenticated cause go get to fail. You don’t need to authenticate Go requests for projects that are not in subgroups.

However, in 17.4, It's now require all go get requests to private project to be authenticated.

e.g. curl http://githost/very/private_project?go-get=1 return 401

This bug affects self hosted instance.