disallow web-based add/edit/remove

these actions should only be possible from console