Hmm... need more server side logic than I expected, at least until we have some sort of permissions/host logic (or we can just do it unsafely clientside, which is probably fine).