I think we want all requests authenticated, and an implicit mechanism will only retrieve objects I am allowed to access.