If I understand this correctly, it was quite a rookie mistake on Badspots part to not include the authentication provision in a guarded function.