do not allow list creation to unauthed users; closes #23