It's probably worth inserting a sentence on why we do this. 

The 'regcore_write' is written with no authentication. If it's enabled, anyone with access can write to the API. It's meant to be turned on only in secure, limited access environments.