fixes #2404 - prevents 404 when updating invalid name used as id
fixes #2645 - non-admin users can now create smart variables