> The SP does not protect its own endpoints, ever, AFAIR. It shouldn't, but I AFAIR it is possible and has shown up on this list several times. It was back in the days before 2.4-style configuration and better documentation, which makes it much harder to do it by accident.