users can add regions

You should probably prevent non-admins from being able to create regions. (I can still POST to this URL, even though you hid it in the view)