Making APIs RESTful, disallowing non-admin users to perform write actions