This is similar to Tool consumer profile. According to http://www.imsglobal.org/lti/ltiv2p0/ltiIMGv2p0.html#_Toc361225459 this should be accessed by GET. So it may be ok to allow unauth access to it from LTI point of view. So please disregard previous comment.