made simplistic security -- guard /posts/* from editing, but allow demo links