IP-based restrictions work now.  There's also an `authkey' verbosity keyword.