I'm not using AUTH, it's a normal ephemeral event sent over HTTP that the git-server immediately discards, but I like your idea more. We need a spec for that.