This is always an update, you can't add people here
Add CSRF checks here

This could easily have been used to target admins and automatically
delete all users - or worse - inject SSH keys to anyones account