SECURITY: TopicsController#posts was not checking Guardian