Secure domain: not working, not asking for auth

So… I followed the tutorial and read all the other tutorials (basically all telling the same, which is good), but meet isn’t asking me for authentication.

The http-bind responses include from=“guest.mydomain”, so I assume I’ve been assigned guest - but why am I allowed to create rooms then?

edit: I’m running debian 9 (oldstable), if that matters (guess not).