I understand the advantages of supporting SMS MT+MO and network auth, but IMO it's dangerous to support all these in our v1 API if:

1) the clients we implement and release don't support these alternative mechanisms
2) the server has to resort to heroics to determine which v1 clients support the alternative mechanisms, particularly with the requirement that the server determines the auth method in `/register`

If our v1 clients are only going to support SMS MT, I propose the v1 API only supports SMS MT, and we move to a v2 API when we're actually going to support the alternative mechanisms (where the server determines the auth method). Then from a server perspective, it's clear what the capabilities of the client are.