Hi, Cryptic URL is sufficient to authenticate merging requests. Merges should succeed with authenticated users or unauthenticated ones. Please pull 6edd07b which implements this (together with already applied 0365e4a). Christophe