If we do end up putting the auth on the resource side, we should probably either check the auth using the `auth` param given to this method, or not offer it as a param if we don't do any checking with it.