Consider alternatives to Authorization header to simplify client implementation

[cqr]

No description provided.

[mahemoff]

I like the idea of supporting private feeds with a "secure" random URL, since many apps and hosts already support them. One downside of this is that every new user adds a new feed to be fetched, which adds more bloat and fetching requirements.

To get best of both worlds, it may be possible to embrace canonical links. Private feed URLs (e.g. https://example.com/amazing-show?id=hard-to-guess) could then link to a canonical feed (e.g. https://example.com/amazing-show), which is accessed by any valid token, as proposed in #9.

This means bearer token auth doesn't even have to be mandated in the initial version of the spec. It makes PodPass more of an extension of the existing private URL convention, but later on could add token support via canonical links and the multi-token access proposed in #9.