I like this, but it does make it difficult to discuss the PR. Perhaps you could issue a private key or token in response to the POST and then add comments with that key/token?