change SAM to SiteManager. That should protect the handler from
unauthorized access.