I can ask a server for a list of entries, and the server will give me both the list, and a set of URLs with which I can interact with those entries in the list. My suggestion is that we really need to have some additional information from the server to tell us what security information is required when we interact with those URLs. Ideally we would have one piece of metadata for each URL, so that not only can some 'blog service' have its security mechanism set, but each entry could also be accessed with a different mechanism.