It would be good to have any type of auth for app with all api requests signed with access token that lasts some period of time.