Only digest entities if not present in the charm store.

Store the bzr-digest extra-info for all the ingested entities, and compare the value in subsequent charmload calls.
although it's entirely possible that some GET methods might require auth in the future.

so... on balance i think it's more future-proof to just send auth for everything.