'readers' file not respected on CVS (1.10.7) server machine

[andy]

I am trying to only allow read-access to the CVS repository to a 
generic, anonymous QA user (qauser). I am using Unix client/server 
with password authentication but no CVS password file.

I created $CVSROOT/cvsroot/readers to include 'qauser'.

Updates (cvs commit) are disallowed correctly from another machine 
but still work when initiated from the server machine housing the CVS 
repository.

The value of CVSROOT is identical and the Unix user is the same 
(qauser) :-

$ echo $CVSROOT
$ :pserver:address@hidden:/usr/local/cvsroot

This is CVS (1.10.7) for both client/server on SuSE Linux.
Any ideas ?