Local Users "su'ing"

Hi,

I'm running postgresql 7.0.2 under FreeBSD 4.1-STABLE. If a user runs
pgsql from the command line and then types \c - <user> they can connect to
the database with the priveleges of <user>. No password is required,
presumably because of the line in pg_hba.conf:

local        all                                           trust

Great fun for someone who su's to pgsql...

A couple of questions...

1) This seems to be an odd default behaviour. Should it be documented
fairly clearly somewhere (perhaps it is but I missed it) or should the
default pg_hba.conf require passwords?

2) Is it possible to not require passwords if the local user connects to
postgres as a postgres user of the same name but require a password in all
other circumstances?

3) Does the search engine on the web site usually work? It keeps telling
me its stalled when I try to search the list archives. The same thing
happened a while ago but I thought it was just a temporary thing.

Thanks,

Andrew