This seems like something that shouldn't be listening on 0.0.0.0, so no auth wouldn't be absolutely terrible. But everyone knows that someone will use this on

This seems like something that shouldn't be listening on 0.0.0.0, so no auth wouldn't be absolutely terrible. But everyone knows that someone will use this on a production server with unsafe settings, especially if it doesn't restrict access by default.