The methods require_auth allows. restricted is false when it is empty: anything goes.
require_auth
restricted