fixes #2860 - don't convert arbitrary input into symbols (CVE-2013-4180)
fixes #2863 - restrict APIs to resources that a user is permitted to manage (CVE-2013-4182)