validate user permissions on POST to /requests
bump travis-core