Auth rules: clarify that the resident server must sign a restricted join event.