Good catch, yeah, I always forget this. I'm not sure how critical it is in this case since we don't expect this to be deployed on the open internet, but better safe than sorry.