Turn off cgit?

There are still workable options other than disabling it, like a trivial password barrier or putting it behind a cookie that would be acquired via the normal path humans typically take. These things do still work and crawlers have not yet tried to circumvent them, as far as I can see. It effectively turns an expensive CGI call into a static error page delivery, which is much less compute intensive. And if humans hit the protection, it's obvious and easy for them what to do. Of course, I realize that this barrier will also eventually be torn down, if enough people start to use it. And then the only solution left is to put it behind a real auth barrier or shut it off.