Site Access not restricting creation of non-authorized accounts

I used pubcookie site access to restrict users having access to a site to three valid pubcookie users. When I had a forth person who had a valid pubcookie login but was not in the list of three to log in from /login/pc their login was successful and a new account was created for them.

I counsel changing line 84 in pubcookie.module from

if (isset($account->uid) && $account->uid != 1) {

to

if (! $account || (isset($account->uid) && $account->uid != 1)) {

I've done so locally and it works as I expect. Hopefully my expectations are correct!