Fix security bug reported by Konstantin Gribov

This bug allowed anyone to edit any mod so long as they were _not_
logged in by appending "/edit" to the URL. Thanks, Konstantin!
Apply additional fixes to security issue
Fix some additional issues with permissions