@kopper @hazelnoot @erincandescent there are a few diff ways to do that i think:
- sign your http GET
- or, obtain an oauth token and use it for GET
- or, start a session directly on the target site, using credentials or OIDC or some kind of federated identity

this is where i was talking about auth-schemes and WWW-Authenticate earlier, it would be nice to know which schemes were supported for viewing private resources