We should mandate that /publicRooms requires an access_token (SPEC-321)

[matrixbot]

Submitted by @​matthew:matrix.org
Such that people who want to ACL the directory depending on who's viewing it can do so

(Imported from https://matrix.org/jira/browse/SPEC-321)

[matrixbot]

Jira watchers: @dbkr

[matrixbot]

Do we make this an option, or do we just do it everywhere?
I can see the value of keeping a public room list you can get without an access token, maybe rooms that are neither peekable or joinable by guests don't appear unless you give an access token? I think I'd prefer to have separate endpoints because getting a partial roomlist if your access token has expired sounds like the way madness lies. I think I would rather have endpoints that either work all the time or only when you have a valid login.

-- @dbkr

[richvdh]

I think I'd prefer to have separate endpoints ... I think I would rather have endpoints that either work all the time or only when you have a valid login.

I think I agree with this.