Also prevent authorization
on update.

I need a controller test for this, and I also need to ship today. So
I'm going to not write a test, and file a bug for later.