Don't let anyone destroy/update anyone else

@bomatson, be careful with the routes you expose, or you might
lose your entire database. Never add destructive actions to your
controllers without some kind of authentication, or anyone can
just curl your website with the right HTTP verb and mess up your DB