Allow unauthenticated downstream connections to create a bouncer account via account-registration.
In the config file, add a knob to allow anonymous registration. Have an option to require admin approval before the account gets activated.