Imagine email-subscriptions permissions for an anonymous-role are set to this:

(simplified)

  insert: {}
  update: { secret: "x-hasura-secret"} (got-from-email)

By requiring x-hasura-secret in update, I get an error, when trying to insert, which should't require the x-hasura-secret header.

"x-hasura-secret" header is expected but not found

Is this a bug, or a feature?
Thanks