Yeah, I have some strong opinions about security and auth, I'd like to got through it in more detail. Let's discuss it on the API spec pull request.