auth/flat: disallow AUTH unless private IP or TLS
Merge pull request #431 from msimerson/flat

Merged. Ta.