Lower required authentification level for STATS
The STATS interface currently needs admin previleges. If you want to give an external entity access to the STATS interface you have to give them your admin password and therefore the control over the whole server. Requiring just e.g. relay previleges for the STATS interface would solve this.