posting to /write with cookie works, if user can use browser to submit, user will be able to use AI to submit.
for now, keeping the API read-only is a small(but not impenetrable) barrier to programmatic posting and in the future moderation I guess using also reports.