A signup list's public display config plus a fresh submit nonce

Authenticate every request with Authorization: Bearer <token> — a JWT or API token.