Fix possible security hole. Only allow admin to download pl_config