Comment by robk

Is that extra database call to get auth status really that costly? Having the client hold any kind of access control is scary to me.