Move plugin list update to `plugins.yml` and add authentication to the postBack request