isn't this wrong? how can I auth if this thing requires protected event but the spec says protected events are only allowed for authenticated users? this should not require that the auth event has the protected tag.. or am i missing something?