More security fixes

Prevented promoters from just changing the contract id in the url to
access things they shouldn't
Trying to push