removed insecure, allowed user to post