[bo1024]

I'm not seeing why there's a clear line where GET cannot be authentication but POST can.

[prophesi]

Because there isn't a line? You can require auth for any of those HTTP methods. Or not require auth for any of them.