clean up some product methods and add security

A bunch of rewriting of cloning, but I think the logic stayed the same. Otherwise just added some comments, return values, and added an "admin" role check to the two methods that didn't have it (assuming that's correct).