Ban a room

Bans a room from the index. Yes, it is a GET that mutates state, we know, and no, we are not proud of it. And a User-Agent containing "bot" gets a 403 even with valid credentials, a scar from crawlers tripping this, not a feature. Both are real behavior, documented on purpose so they surprise you here and not in production.