- Allow CI job tokens
- Return 401 when project is not public and request is not authenticated
- Add assertions to spec to verify authn/authz