fix(controller): disallow evil users from creating builds