Introduce an authentication flag so APIs can opt into authentication dances (most legacy ones will have to)