Put review template on a separate protected resource
Require authorization to post review data
Add user as reviewer