It's not a problem because we're not sending in an entire query, we're just setting the filter clause.

Also, admins already have access to the datastore viewer where they can do much more damage if they want, not to mention managing app deployment.

I think what may be called for is a new role.

See new bug https://github.com/getlantern/lantern/issues/1080