ext:server support for --allow-root?

[Gary Funck]

After the previous discussion regarding pserver, I'm
considering continuing our use of :ext:server+ssh,
but need to extend it to allow write access to
a repository that is on an internal machine behind
the firewall.

One suggestion is documented here,
http://ximbiot.com/cvs/wiki/CVS%20FAQ
under "How do I access an internal CVS server via an SSH gateway?"

The write says: "This is only for cases where you cannot
tunnel without a key."  What situations is it talking about?
How would one set things to provide tunneling without a key?
IP forwarding?  Changing the firewall router so that allows
direct access to the (NAT'ed) internal server's ssh port?
Not my preference.

The author suggests:
  ssh -t address@hidden ssh "$@" 
executed from the firewall'd host.
I'd like to change that to:
  ssh -t address@hidden  \
    ssh "cvs server --allow-root=<path_to_cvs_root>"
to restrict the CVS repositories that this external server
can access.  Is this possible?  I saw patches that support this,
described here: http://ioctl.org/unix/cvs/
that support this feature, but am wondering if cvs 1.11.22
supports this feature?

thanks,
  - Gary