Ensure all our ActivityPub fetches are authenticated (#758)