I added HTTP/HTTPS, authentication and CORS related topics to descriptions in the specification.
The text about CORS (almost) follows GA4GH recommendations and authentication tries to follow WES pattern.
We might revise later to impose security schemes directly in OpenAPI, but it wold be good to have GA4GH or at least Cloud WS common practices first.
I added HTTP/HTTPS, authentication and CORS related topics to descriptions in the specification. The text about CORS (almost) follows GA4GH recommendations and authentication tries to follow WES pattern. We might revise later to impose security schemes directly in OpenAPI, but it wold be good to have GA4GH or at least Cloud WS common practices first.