I don't think we technically need authentication here, since we're using UUIDs for call IDs. Possession of the call ID should be enough proof of authorization to manipulate the call.