You can clone with
HTTPS or Subversion.
Authentication is normally a server-side feature. However, Create could potentially provide support for BrowserID with a simple API to verify the login on the server. This shouldn't be pushed as a requirement, but instead as a "sensible default".