@sun @mint @david @pwm @i @phnt @hfaust We should never allow an unauthenticated request (not one of our users) make external API calls that can hang and delay our ability to respond.

Kinda think the smart thing to do would be to deny the first attempt at authenticated fetch because we don't know them and insert an Oban job to fetch their instance actor. Future requests could then begin working, possibly within a second or two. Also will let us prevent duplicates / hammering their server with requests by limiting unique jobs to once per domain like every 5 mins or something