This begs for question -- do we want to allow non-ip traffic for authenticated users? !