it didn't think to extend it to the websocket message reader tho. this means the socket would remain open and they would be able to keep doing it without having to go through the websocket upgrade process.

adding this now so that the websocket protocol immediately drops the connection of an IP that has 3 times attempted event publish without authing when required.

for the HTTP API it will not block requests because they are one at a time, read events will not be blocked, only writing events for the 10 minute

processing events costs compute and database queries. this reduces that load, for auth disrespectoors.

because fuck them. they are braindead jerkwads.