improving security of script extension

- requiring admin access
- requiring that default admin password has been changed

depends on #367.