You must put authorization on your server if you don't want others connecting to it.

While the right of access is not granted by AGPL - it is not reasonable to run a public service with an AGPL client and say you shouldn't be connecting to it.

They are doing a lot of work to create implied consent under CFAA.

If you want to control access you must do something to control access - it must reach a threshold, it cannot just be a public user agent string.

> You must put authorization on your server if you don't want others connecting to it.

Unfortunately, the CFAA doesn't necessarily require that authorization is implemented through technical means, and it definitely doesn't require any authorization to be technically robust.