auth doesn't stop spam

it enables THE PEOPLE RUNNING THE SERVER to allow IN who they allow, for whatever reason

i really don't think you have thought about this