moby: [1.12.0-rc2] Joining a remote node without --manager doesn't require acceptance

Output of docker version:

Client (laptop, OSX)

$> docker version
Client:
 Version:      1.12.0-rc2
 API version:  1.24
 Go version:   go1.6.2
 Git commit:   906eacd
 Built:        Fri Jun 17 20:35:33 2016
 OS/Arch:      darwin/amd64
 Experimental: true

Server:
 Version:      1.12.0-rc2
 API version:  1.24
 Go version:   go1.6.2
 Git commit:   a7119de
 Built:        Fri Jun 17 22:09:20 2016
 OS/Arch:      linux/amd64
 Experimental: true

Server:

Client:
 Version:      1.12.0-rc2
 API version:  1.24
 Go version:   go1.6.2
 Git commit:   906eacd-unsupported
 Built:        Fri Jun 17 21:21:56 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.12.0-rc2
 API version:  1.24
 Go version:   go1.6.2
 Git commit:   906eacd-unsupported
 Built:        Fri Jun 17 21:21:56 2016
 OS/Arch:      linux/amd64

Output of docker info:

Client:

Containers: 78
 Running: 0
 Paused: 0
 Stopped: 78
Images: 51
Server Version: 1.12.0-rc2
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 344
 Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: overlay bridge null host
Swarm: inactive
Runtimes: default
Default Runtime: default
Security Options: seccomp
Kernel Version: 4.4.13-moby
Operating System: Alpine Linux v3.4
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 1.954 GiB
Name: moby
ID: AX3N:B5KC:6TY6:V5UW:5MAH:JSD3:PXBN:HC3H:GF3L:GC7L:Z35R:KAIW
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): true
 File Descriptors: 33
 Goroutines: 95
 System Time: 2016-06-20T22:09:37.819574454Z
 EventsListeners: 1
No Proxy: *.local, 169.254/16
Registry: https://index.docker.io/v1/
Experimental: true
Insecure Registries:
 127.0.0.0/8

Server (swarm cluster):

Containers: 0
 Running: 0
 Paused: 0
 Stopped: 0
Images: 0
Server Version: 1.12.0-rc2
Storage Driver: aufs
 Root Dir: /var/lib/docker/aufs
 Backing Filesystem: extfs
 Dirs: 0
 Dirperm1 Supported: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: overlay host null bridge
Swarm: inactive
Runtimes: default
Default Runtime: default
Security Options: apparmor seccomp
Kernel Version: 4.4.0-24-generic
Operating System: Ubuntu 16.04 LTS
OSType: linux
Architecture: x86_64
CPUs: 1
Total Memory: 991.1 MiB
Name: docker1
ID: LOR7:TUJW:PXCF:SGKX:L5LU:GQCT:UTRN:G72M:JU32:I24J:JN3R:BN34
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Insecure Registries:
 127.0.0.0/8

Additional environment details (AWS, VirtualBox, physical, etc.):

Steps to reproduce the issue:

1. Set up a remote swarm cluster - mine is 4 remote nodes, 2 leaders
2. On your laptop, run:

$> docker swarm join swarmIP:2377
This node joined a Swarm as a worker.

1. On the leader:

docker node ls
ID                         NAME     MEMBERSHIP  STATUS  AVAILABILITY  MANAGER STATUS
09y7cdu03xmuwhta0ykvd72gb  docker4  Accepted    Ready   Active        Reachable
1jkzrkblwbdig3l5u29997n00  docker1  Accepted    Ready   Active        Leader
41znz1ntskwvvvea8up52wu0m  docker2  Accepted    Ready   Active        
5bt1bcak4tuzm9a39a7ou9upz  docker3  Accepted    Ready   Active        
7ljlfo1zqcid0mc8cmir64i6g  moby     Accepted    Ready   Active 

Describe the results you received:

My ‘rogue’ laptop was able to join the swarm cluster as a worker and shows up in the manager list as ready and active.

Describe the results you expected:

I expected the join command to require approval from a manager node as it does in manager mode

Additional information you deem important (e.g. issue happens only occasionally):