private conference server with jabberd-1.4.3 and jabber-muc

Question

Debian lenny, jabber-1.4.3-3.4, jabber-muc-0.6.0-2.1.

I've got jabberd set up on a server that has a public IP (ie. it's not just an in-house box). Muc is working well, can create rooms, logging works, etc. My problem is that it looks like any XMPP user anywhere can query the room list on the conference server and (worse) can create rooms there. The persistent rooms that I have configured are not visible, but how can I prevent unauthenticated users from creating rooms?

Here's my /etc/jabber/jabber-muc.xml:

<jabber>

  <service id="muclinker">
    <uplink/>
    <connect>
      <ip>127.0.0.1</ip>
      <port>31518</port>
      <secret>secret</secret>
    </connect>
  </service>

  <service id="conference.example.com">
    <load>
       <conference>/usr/lib/jabber/mu-conference/mu-conference.so</conference>
    </load>
    <conference xmlns="jabber:config:conference">
      <public>0</public>
      <vCard>
        <FN>Private Chatrooms</FN>
        <DESC>This service is for private chatrooms.</DESC>
        <URL>http://conference.example.com/logs/</URL>
      </vCard>
      <history>20</history>
      <logdir>/var/lib/jabber/conference.example.com/logs/</logdir>
      <sadmin>
        <user>webmaster@example.com</user>
      </sadmin>
      <notice>
        <join>has become available</join>
        <leave>has left</leave>
        <rename>is now known as</rename>
      </notice>
    </conference>
  </service>

  <pidfile>/var/run/jabber/jabber-muc.pid</pidfile>

</jabber>