Function decide_admission 

pub fn decide_admission(
    door: Door,
    offered: Option<&str>,
    face: &BindFace,
) -> Admission

Decides whether one HTTP request may reach the work behind a door.

The one place an HTTP caller’s pairing token is judged. A door that judged nothing would let anyone who could reach the port of an exposed city spend money at a provider.

The rule is the face’s, which is why the face is what arrives: a face that demands no credential is the loopback face of a city nobody configured a token for, and it came from decide_bind, which refuses to serve an exposed one. There is nobody to distinguish on such a city, so every door admits as paired.

Door::Acp is admitted unpaired on purpose: what an unauthenticated editor may learn is agent_protocols::admit’s to word, and it words it so that a stranger learns exactly one bit. The other three doors act, so they refuse here.