I think I'll go with the global approach, unless you think otherwise.  I tip in that direction because it could satisfy the legitimate migration case for pre-existing apps that use SmartStore but don't bother with authentication.