Only allow admins to make changes via API