Comment by cowlevel

What's the right level of lockdown? Starting a page with "if not authorized, return 403" would've seemed adequate before this.