fix(controller): disallow evil users from creating builds

closes #2811