This is the same way I have it for some months, it works well for me to be able to detect from which pubkey they are uploading and block.
Yeah, since we had it wide open until now, some clients have foregone the authentication and now I need to make sure I do not rug anyone. Already found one potential impacted client and will wait until they solve the problem 🐶🐾🫡