My apologies:
You are running into a browser cache issue that SHOWS the full list IF THE BROWSER PREVIOUSLY HAS shown... for anyone.
the access is still limited
BUT good security practice is to never SHOW what they should not know about.
A cleared cache sees just what it is supposed to.
I simply put the IP:port in again after a successful logon as Anonymous and I see just that