bug: token ignores --projects arguments?

[BenjaminYde]

I have the following setup on my depvi.
As a test i tried to install package-2 (when logged in with the token that should limit to package-1)
Why is is possible to install package-2 why the -p arguments should limit to package-1?

devpi-constrained-2.0.1
devpi-lockdown-2.0.0
devpi-server-6.9.0
devpi-tokens-1.0.1
devpi-web-4.2.0

[BenjaminYde]

I found the problem!
I am using docker with nginx & depvi-lockdown.
The problem was that I did devpi use http://devpi:3141 instead of devpi use http://nginx:80
Then I logged in via the devpi-token
Because I was not connected to the devpi-server (with devpi use) using nginx, the credentials were ignored so as the tokens.