Comment by mehov

> because we want to keep free and logged-out access

But don't you run these checks on logged-in users too?