security update: user cannot make a fake post to grant admin priv