Check that people setting post.userId are actually admins before we set it

/cc @SachaG @ryw