This is the answer. You ACS should also require credentials from the CPE. And your CPEs should require credentials as well.