it could be even shorter I think: you don't need to support anything else than GET, to you can remove auth as well, no ?