Hosted repositories could be treated the same way as remote repositories in source:services/api/app/models/commit.rb: i.e., when validating a job submission, fetch the repository from arvados-git-httpd and put it in the local cache. This removes the current restriction that gitolite and arv-git-httpd must be installed on the same node as the API server. It also helps remove the current restriction that there can be only one API server. *TBD:* With this model, when arv-git-httpd authenticates, there will be three HTTP connections open: client->API->arv-git-httpd->API. This could be avoided or minimized by having giving arv-git-httpd bypass per-repository authentication entirely when given a special pre-shared secret token (similar to keepstore's data manager token), token) or by having it cache credentials (at least admin credentials) and _sometimes_ thereby skip all API lookups when fetching an admin token is used to fetch a repo by UUID.