Yes, backend-authenticated access control is possible. See https://nchan.slact.net/details#authenticate-with-nchan_auth...