Users should be authenticated and only permitted to configure pipelines for their own projects. API should be frozen at this point, with only image processing operations remaining to write.