add server-only write paths
restrict client balance edit permissions
still getting jquery not defined