It might make sense to just _temporarily_ pull in the code that does authenticated requests from Calypso.    Aside; why theme fetching API does need authentication? It shouldn't have anything specific to the customer? I understand the argument for actually applying the design, of course.    Perhaps the flow could simply collect info (for new sites & existing sites) and then at the end, "outside the flow" in Calypso, either apply changes to existing site or create a new site+account.