Edit: I should clarify I am only really opposed to #1 and #4. I was also in a rush and didn't see the PF bypass. As long as it can be bypassed, go right ahead and restrict all you want