Should work like that. Haven't tested it. This might also be a bit more
insecure (not sure), because the check if the connection is allowed is
done during authentication, and I believe when setting it globally that
check is done before. Haven't teste...
