I see, if the client already does the filtering, then it's no big deal. If we later get OAuth 2, we'll do the filtering ourselves.