The question I'm struggling with here: If barbican in not in the catalog, is it ok to hit a backup endpoint from a security perspective? I'm thinking the keystone auth middleware of the backup endpoint (if used/configured) will throw a 403?