It hard to secure this service in DMZ without firewall rules, and sometimes
its not possible, for example in virtual hosting. 

To simplify authentication I suggest username/password be accepted as part
of get/post request.