Before this change, we'd filter in the UI but calls to the API could allow robots accounts where we only expect real users