Fair points.

\r\n\r\n

htauth on an https server should cover that ground. Note that blocking 'bots makes effectively finding out whether serial rights are lost (if publishing drafts actually does this) rather more difficult. Low hanging fruit and all that.