Make sure metadata-converter.php requires an admin user

Depending on server configuration this may be used in a Denial Of Service attack by tying up all webserver workers with large POST bodies.