HQ-Core is unable to be a public-facing service until permissions are handled. The structure for authentication handling needs designed still. Will it be as simple as a users table with hashed passwords? Will it be OAuth based? Is there a good library for this?
SSL/Encryption is another topic that needs covered. Maybe it can be proxied instead of direct support.