I don't think we should use authentication for this method? It is going to be used by JavaScript clients so it would be fairly easy to find the user and secret; and we do not have any permission management so an attacker could potentially create alerts etc