What's a good way to "protect" a public TRPC endpoint - Theo's Typesafe Cult