I'm not saying that they don't need to check auth by repo. They can still check the auth when they look up the metadata for the file. Just don't include it in t

I'm not saying that they don't need to check auth by repo. They can still check the auth when they look up the metadata for the file. Just don't include it in the URL. The auth difficulty may make moving the files to a different domain more difficult, but same domain path shouldn't matter.