Right now, creating and updating an origin should require auth of some kind. Retrieving an origin should not. Don't make the same mistake of tying ourselves to any one provider too tightly.