[webui] don't require source access by default
[webui] ignore bots trying to break into our system