Prevent role escalation

haven't touch Yii framework before, pretty sure there's a build in function to prevent this.