disallow puppet access from clients for now