Check that people setting post.userId are actually admins before we set it
Merge pull request #153 from queso/dont-trust-clients

Check that people setting post.userId are actually admins before we set it