Changed the name of sha256 to hash
Added checks for POSTS

Don't allow signed-in users to do things that only
signed-out users can do, and vice versa.