Good catch! Yes, we are missing SOAP and REST services to assign a step. We will include these services in out 10.1 release.
About authentication, ArcGIS Server provides several ways to secure your services (including Workflow Manager services). You can enable token based authentication, et cetera. As a result, Workflow Manager itself does not need to provide any login or authentication mechanism, because you can just make use of the ArcGIS Server level authentication.
Hope this helps,
Thanks,
Raghu