Don't allow unauthorized users to do certain actions.
Fixes #641