Yeah I agree—they should use the AGPL as that’s the one that protects on the server side.