Thanks Brent, that's what I feared, too much editing.
I found this response to similar question at StackOverflow: http://stackoverflow.com/questions/30067849/yii2-require-all-controller-and-action-to-login?rq=1, and implemented 'as beforeRequest' in web config, which did the trick. It's a global setting, which would not suit all situations, but does the job for my app.
Mike B