spec to ensure public leagues dont require password