I think you still need a check here to confirm the request is coming from an authenticated superuser. otherwise someone could still spoof the POST and make edits they weren't allowed to