add basic authentication and make it the default for secure submissions

nice catch