Earlier quoted context omitted.
Pretty sure this is meant for prototyping and maybe demoing in controlled environments. As soon as you involve auth, things get boring and annoying.
Honestly, anything simple. It could be as brain-dead simple as passing a password on the command-line, and then requiring the password as a header.
As much as I hate saying it even a simple token in a url parameter might be ok for a prototype.