@henryk Honestly, I'd prefer getting a 402 "no, you didn't pay for this" error over the current "let me send you everything and then script-kiddie lock it" system.