only allow updating certain fields of a post