The 100 requests per minute fee oauth tier is how you would want to handle this right? The requests should be authenticated as if it was the current logged in user anyways.