repo API correctly applies authentication/authorization
to POSTs as well.