Here there is no check at all on wether a challenge is pending or not. Of course admin user can be trusted to not tinker around with request, but in the offchance that a challenge has already been reviewed by some other admin, this update function should block if a challenge is already approved.