I agree that this is how you should use it, but it is not "supposed" to be that in the sense that Tailscale strongly encourages you to use it in lieu of auth...