bugz 4445: limit server actions to appropriate states