Restrict non-admin use of Auth to localhost?

At present _anyone_ can authenticate on https://dwylauth.herokuapp.com and create an App + `AUTH_API_KEY`.
That's a _good_ thing because it allows people to run [`dwyl/app`](https://github.com/dwyl/app) on their localhost with a _single_ environment variable. Right now _nobody_ is using `auth` for any other Apps, just us. So I'm not _concerned_ that anyone will abuse it in the _short_ term.

However ... giving people free-access to an authentication system without any accountability/restrictions,
that _we_ (`@dwyl`) are ultimately responsible for when (_not `if`_) someone abuses it, is probably a bad idea.


Technically the risk of abuse is mitigated by the fact that `auth` does not return the GitHub `access_token` after the `person` record is created. So the _potential_ for abuse is limited to sending someone a spam email. There is no way to perform any _action_ on behalf of the person either on GitHub or Google because the "consuming" app (_the app using `auth_plug`_) never sees the OAuth `access_token`. This was a deliberate choice from a security perspective.

If some unscrupulous person was to use our `auth` system and then send people spam emails,
and the person _receiving_ those emails were to associate our `auth` with that spam, they could _report_ our app ...


With this in mind, should we consider restricting creation of `app` and `AUTH_API_KEY` to people with a specific role?
i.e: restrict all new apps to `localhost` and create a means to request derestriction?