Blocking only client side.
Authorize only for dev server side.
Merge branch '0.1-DevOnlyCanChangeStatus' into 0.1